CVE-2018-9077
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
- Score
- CVSS 3.0 8.1 High
- Status
- Modified - psirt@lenovo.com
- Published
- 2018-09-28
- Last modified
- 2024-08-05
- Weaknesses
- CWE-78
Affected products
- Lenovoemc Firmware (Lenovo)
- Ez Media And Backup Center (Lenovo Group Ltd)
- Iomega Storcenter (Lenovo Group Ltd)
- Lenovoemc (Lenovo Group Ltd)
References
- https://support.lenovo.com/us/en/solutions/LEN-24224
