CVE-2018-9075

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Lenovo Group LTD	Iomega StorCenter	>= 4.1.402.34662, <= 4.1.402.34662
Lenovo Group LTD	LenovoEMC	>= 4.1.402.34662, <= 4.1.402.34662
Lenovo Group LTD	EZ Media and Backup Center	>= 4.1.402.34662, <= 4.1.402.34662

References

https://support.lenovo.com/us/en/solutions/LEN-24224Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24224Vendor Advisory

Timeline

Published: Sep 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-90768.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90778.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90788.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability CVE-2018-90799.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object CVE-2018-90805.9For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logg CVE-2018-90814.7For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Cont CVE-2018-90828.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenti CVE-2018-90838.1In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to th CVE-2018-90846.5In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software upda CVE-2018-90854.9A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an att CVE-2018-90867.2In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a pri CVE-2018-90906.1CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the