VulnerabilityModified
CVE-2019-6178
An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled.
MEDIUM 5.3EPSS 1.10%
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their contents.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Affected
- lenovo/px12-350r firmware · lenovo/ix12-300r firmware · lenovo/home media network hard drive firmware · lenovo/storecenter ix2-200 firmware · lenovo/storecenter ix4-200d firmware · lenovo/storecenter ix4-200rl firmware
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/solutions/LEN-25557Vendor Advisory
- https://support.lenovo.com/solutions/LEN-25557Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.