CVE-2018-9077

HIGH

LenovoEMC Firmware < 4.1.402.34662 - OS Command Injection via Share Name Parameter

Title source: llm
STIX 2.1

Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://support.lenovo.com/us/en/solutions/LEN-24224

Scores

CVSS v3 8.1
EPSS 0.0178
EPSS Percentile 82.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
lenovo/lenovoemc_firmware < 4.1.402.34662
Published Sep 28, 2018
Tracked Since Feb 18, 2026