8.0
High
CVE-2021-42852 A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an…
Description
A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Personal Cloud Storage A1 5.3 | earliest → < 5.3.6.a1 | 5.3.6.a1 |
| Personal Cloud Storage T1 5.3 | earliest → < 5.3.6.t1 | 5.3.6.t1 |
| Personal Cloud Storage X1 5.3 | earliest → < 5.3.8.x1 | 5.3.8.x1 |
| Personal Cloud Storage T2 5.3 | earliest → < 5.3.8.t2 | 5.3.8.t2 |
| Personal Cloud Storage T2Pro 5.3 | earliest → < 5.3.7.t2-pro | 5.3.7.t2-pro |
Other CVEs of Personal Cloud Storage A1
The 5 CVEs of Personal Cloud Storage A1 →
CVE-2021-42851
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to…
6.3
Medium
CVE-2021-42850
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud…
8.8
High
CVE-2021-42849
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could…
6.8
Medium
CVE-2021-42848
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an…
4.3
Medium