Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2018-9082 Details

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://support.lenovo.com/us/en/solutions/LEN-24224	CVE	Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24224	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-384	Session Fixation	[email protected]

Affected Products

Product	Versions
lenovo storcenter px12-450r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px12-450r	All versions
CPE cpe:2.3:h:lenovo:storcenter_px12-450r:-:::::::* Remediation No remediation found in references.
lenovo storcenter px12-400r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px12-400r	All versions
CPE cpe:2.3:h:lenovo:storcenter_px12-400r:-:::::::* Remediation No remediation found in references.
lenovo storcenter px4-300r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px4-300r	All versions
CPE cpe:2.3:h:lenovo:storcenter_px4-300r:-:::::::* Remediation No remediation found in references.
lenovo storcenter px6-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px6-300d	All versions
CPE cpe:2.3:h:lenovo:storcenter_px6-300d:-:::::::* Remediation No remediation found in references.
lenovo storcenter px4-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px4-300d	All versions
CPE cpe:2.3:h:lenovo:storcenter_px4-300d:-:::::::* Remediation No remediation found in references.
lenovo storcenter px2-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter px2-300d	All versions
CPE cpe:2.3:h:lenovo:storcenter_px2-300d:-:::::::* Remediation No remediation found in references.
lenovo storcenter ix4-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter ix4-300d	All versions
CPE cpe:2.3:h:lenovo:storcenter_ix4-300d:-:::::::* Remediation No remediation found in references.
lenovo storcenter ix2 firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter ix2	All versions
CPE cpe:2.3:h:lenovo:storcenter_ix2:-:::::::* Remediation No remediation found in references.
lenovo storcenter ix2-dl firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo storcenter ix2-dl	All versions
CPE cpe:2.3:h:lenovo:storcenter_ix2-dl:-:::::::* Remediation No remediation found in references.
lenovo ez media & backup center firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:ez_media_&_backup_center_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo ez media & backup center	All versions
CPE cpe:2.3:h:lenovo:ez_media_&_backup_center:-:::::::* Remediation No remediation found in references.
lenovo px12-450r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px12-450r	All versions
CPE cpe:2.3:h:lenovo:px12-450r:-:::::::* Remediation No remediation found in references.
lenovo px12-400r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px12-400r	All versions
CPE cpe:2.3:h:lenovo:px12-400r:-:::::::* Remediation No remediation found in references.
lenovo px4-400r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px4-400r	All versions
CPE cpe:2.3:h:lenovo:px4-400r:-:::::::* Remediation No remediation found in references.
lenovo px4-300r firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px4-300r	All versions
CPE cpe:2.3:h:lenovo:px4-300r:-:::::::* Remediation No remediation found in references.
lenovo px6-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px6-300d	All versions
CPE cpe:2.3:h:lenovo:px6-300d:-:::::::* Remediation No remediation found in references.
lenovo px4-400d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px4-400d	All versions
CPE cpe:2.3:h:lenovo:px4-400d:-:::::::* Remediation No remediation found in references.
lenovo px4-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px4-300d	All versions
CPE cpe:2.3:h:lenovo:px4-300d:-:::::::* Remediation No remediation found in references.
lenovo px2-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo px2-300d	All versions
CPE cpe:2.3:h:lenovo:px2-300d:-:::::::* Remediation No remediation found in references.
lenovo ix4-300d firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo ix4-300d	All versions
CPE cpe:2.3:h:lenovo:ix4-300d:-:::::::* Remediation No remediation found in references.
lenovo ix2 firmware	4.1.402.34662
CPE cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:::::::* Remediation No remediation found in references.
lenovo ix2	All versions
CPE cpe:2.3:h:lenovo:ix2:-:::::::* Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 7, 2019	Initial Analysis	[email protected]

CVE-2018-9082 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation