CVE-2019-6178
Last modified
CVE-2019-6178 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their contents.. EPSS estimates a 1.10% chance of exploitation in the next 30 days.
Description
An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their contents.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Px12-350r Firmware | 4.0.24.34808 |
| Lenovo | Ix12-300r Firmware | 4.0.24.34808 |
| Lenovo | Home Media Network Hard Drive Firmware | 3.2.16.30221 |
| Lenovo | Storecenter Ix2-200 Firmware | 3.2.16.30221 |
| Lenovo | Storecenter Ix4-200d Firmware | 3.2.16.30221 |
| Lenovo | Storecenter Ix2-200 Firmware | 2.1.50.30227 |
| Lenovo | Storecenter Ix4-200d Firmware | 2.1.50.30227 |
| Lenovo | Storecenter Ix4-200rl Firmware | 2.1.50.30227 |
References
- https://support.lenovo.com/solutions/LEN-25557Vendor Advisory
- https://support.lenovo.com/solutions/LEN-25557Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-6178?
How severe is CVE-2019-6178?
How do I fix CVE-2019-6178?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-6172A potential vulnerability in the SMI callback function used …6.4
- CVE-2019-6173A DLL search path vulnerability could allow privilege escala…6.5
- CVE-2019-6174Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2019-6175A denial of service vulnerability was reported in Lenovo Sys…7.5
- CVE-2019-6176A potential vulnerability reported in ThinkPad USB-C Dock Fi…7.5
- CVE-2019-6177A vulnerability reported in Lenovo Solution Center version 0…9.8
- CVE-2019-6179An XML External Entity (XXE) processing vulnerability was re…7.5
- CVE-2019-6180A stored cross-site scripting (XSS) vulnerability was report…4.8
- CVE-2019-6181A reflected cross-site scripting (XSS) vulnerability was rep…6.1
- CVE-2019-6182A stored CSV Injection vulnerability was reported in Lenovo …4.9
- CVE-2019-6183A denial of service vulnerability has been reported in Lenov…7.5
- CVE-2019-6184A potential vulnerability in the discontinued Customer Engag…7.8
Are you affected by CVE-2019-6178?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST