CVE-2018-9074 Iomega and LenovoEMC NAS Web UI Vulnerabilities
Attackers can upload files to arbitrary locations on the NAS operating system as root via the Content Explorer application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-9074?
CVE-2018-9074 is a medium-severity path traversal vulnerability in Lenovo Group LTD EZ Media and Backup Center, published on 28 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.
Weakness: CWE-22
Which versions are affected by CVE-2018-9074?
It affects 1 product.
Products include Lenovo Lenovoemc Firmware.
How do I fix CVE-2018-9074?
No fix has been published for CVE-2018-9074 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-9074 being exploited?
There is no known exploitation of CVE-2018-9074 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Group LTD EZ Media and Backup Center
Sources
Also known as GHSA-4hcc-63qf-cfqh.