CVE-2009-2367: cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attacke...

Security readout for executives and security teams

Iomega StorCenter Pro management CGI created session identifiers that were predictable. An unauthenticated remote attacker could guess a valid active session token and take over that session, potentially gaining the user’s privileges. This is most urgent for any legacy StorCenter Pro still reachable over the internet or untrusted networks. Exposure is likely limited to legacy Iomega StorCenter Pro devices with the web management interface reachable. Risk is materially higher if the CGI interface is internet-facing or accessible from shared internal networks. Prioritize containment and retirement review for any exposed device. The business risk is unauthorized administrative access to legacy storage infrastructure, especially where sensitive files or backups are stored. Mitigation focus: Inventory any Iomega StorCenter Pro devices and management URLs.; Remove management interfaces from internet and untrusted network access.; Restrict access with VPN, firewall rules, and administrative network segmentation..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.