CVE-2018-9080: Lenovo Ez Media & Backup Center Firmware

Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days.

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

Affected products

• Lenovo Ez Media & Backup Center Firmware: version 4.1.402.34662 only
• Lenovo IX2 Firmware: version 4.1.402.34662 only
• Lenovo IX4-300d Firmware: version 4.1.402.34662 only
• Lenovo PX12-400r Firmware: version 4.1.402.34662 only
• Lenovo PX12-450r Firmware: version 4.1.402.34662 only
• Lenovo PX2-300d Firmware: version 4.1.402.34662 only
• Lenovo PX4-300d Firmware: version 4.1.402.34662 only
• Lenovo PX4-300r Firmware: version 4.1.402.34662 only
• Lenovo PX4-400d Firmware: version 4.1.402.34662 only
• Lenovo PX4-400r Firmware: version 4.1.402.34662 only
• Lenovo PX6-300d Firmware: version 4.1.402.34662 only
• Lenovo Storcenter IX2-Dl Firmware: version 4.1.402.34662 only
• Lenovo Storcenter IX2 Firmware: version 4.1.402.34662 only
• Lenovo Storcenter IX4-300d Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX12-400r Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX12-450r Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX2-300d Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX4-300d Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX4-300r Firmware: version 4.1.402.34662 only
• Lenovo Storcenter PX6-300d Firmware: version 4.1.402.34662 only

Published 2018-09-28. Last modified 2026-06-17.