What is the CVSS score of CVE-2018-9079?

CVE-2018-9079 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Storcenter Px12 450R Firmware CVE-2018-9079

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2018-09-28 psirt@lenovo.com

Lenovo XSS Storcenter Px12 450R Firmware Storcenter Px12 400R Firmware Storcenter Px4 300R Firmware Storcenter Px6 300D Firmware Storcenter Px4 300D Firmware Storcenter Px2 300D Firmware Storcenter Ix4 300D Firmware Storcenter Ix2 Firmware Storcenter Ix2 Dl Firmware Ez Media Backup Center Firmware Px12 450R Firmware Px12 400R Firmware Px4 400R Firmware Px4 300R Firmware Px6 300D Firmware Px4 400D Firmware Px4 300D Firmware Px2 300D Firmware Ix4 300D Firmware Ix2 Firmware

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 28, 2018 - 20:29 nvd

CRITICAL 9.8

DescriptionNVD

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.

AnalysisAI

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device. Affected products include: Lenovo Storcenter Px12-450R Firmware, Lenovo Storcenter Px12-400R Firmware, Lenovo Storcenter Px4-300R Firmware, Lenovo Storcenter Px6-300D Firmware, Lenovo Storcenter Px4-300D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.