Create phishing page of 29 websites in minutes.

How to fake your phone number: Make it look like….

Lenovo said in a security notice that 4.1.402.34662 and earlier firmware versions are vulnerable to these flaws, so the company has recommended customers to download the firmware version 4.1.404.34716 or later as a security measure. The Zip drive was Iomegas most notable product. This allows a privilege escalation for the attacker to execute commands and act as a normal user. LenovoEMC (formerly Iomega), sometimes styled Lenovo EMC², was a producer of external, portable, and networked storage products.Established in the 1980s in Roy, Utah, United States as Iomega, LenovoEMC sold more than 410 million digital storage drives and disks.It was formerly a public company. Once the static IP address of the vulnerable NAS is established, the attacker can initiate a cross-site request forgery (CSRF) attack against the appliance. This means that finding the devices is not that difficult and would simply require a brute force port scan. “For these reasons, an attack of this nature would probably be against a known target”, the experts in ethical hacking mentioned. The next step in the attack, after acquiring the NAS access token and the “parameter _ C ” is to find the static IP address on which the NAS is running. “Then we use the stored information from the browser to execute commands on the selected devices”. “Only during the investigation, we found a cross-site scripting vulnerability that allowed us to extract information from the browser”, said Rick Ramgattie, expert in charge of the investigation. A hypothetical attack would first include attracting an authenticated NAS user to a malicious website specially designed to steal the user’s access token and a cookie-like session identifier, called “parameter _ C ” from the victim, as reported by specialists in ethical hacking from the International Institute of Cyber Security. To get shell access to devices, attackers have to chain vulnerabilities.

As a result, attackers with access to the user’s session tokens can change their password and retain access to the user’s account”, according to the report published by the Common Vulnerability Scoring System (CVSS). “For some NAS devices like Iomega, Lenovo, LenovoEMC 4.1.402.34662 and earlier versions, the password-changing functionality available to authenticated users does not require the user’s current password to set a new one.

Vulnerable devices include eight LenovoEMC NAS models, nine Iomega StorCenter models, and Lenovo branded devices IX4-300d, ix2, and EZ Media and Backup Center.

Lenovoemc storcenter ix2