title: Iomega and LenovoEMC NAS Web UI Vulnerabilities
description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
problem types: Cross-site scripting (XSS)
affected:
{
product: Iomega StorCenter
vendor: Lenovo Group LTD
versions:
lessThanOrEqual: 4.1.402.34662, status: affected, version: 4.1.402.34662, versionType: custom
}
{
product: LenovoEMC
vendor: Lenovo Group LTD
versions:
lessThanOrEqual: 4.1.402.34662, status: affected, version: 4.1.402.34662, versionType: custom
}
{
product: EZ Media and Backup Center
vendor: Lenovo Group LTD
versions:
lessThanOrEqual: 4.1.402.34662, status: affected, version: 4.1.402.34662, versionType: custom
}
