Hard-coded credentials in Lenovo Personal Cloud Storage A1
Priority LOW 30CWE-798Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.
Why it matters now
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed Personal Cloud Storage A1 (Lenovo): 5.3.6.a1Personal Cloud Storage T1 (Lenovo): 5.3.6.t1+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Personal Cloud Storage A1 | before 5.3.6.a1 | 5.3.6.a1 | Patch available | CNA |
| Lenovo | Personal Cloud Storage T1 | before 5.3.6.t1 | 5.3.6.t1 | Patch available | CNA |
| Lenovo | Personal Cloud Storage X1 | before 5.3.8.x1 | 5.3.8.x1 | Patch available | CNA |
| Lenovo | Personal Cloud Storage T2 | before 5.3.8.t2 | 5.3.8.t2 | Patch available | CNA |
| Lenovo | Personal Cloud Storage T2Pro | before 5.3.7.t2-pro | 5.3.7.t2-pro | Patch available | CNA |
- Personal Cloud Storage A1 VendorLenovo Affected before 5.3.6.a1 Fixed in 5.3.6.a1 Patch available CNA
- Personal Cloud Storage T1 VendorLenovo Affected before 5.3.6.t1 Fixed in 5.3.6.t1 Patch available CNA
- Personal Cloud Storage X1 VendorLenovo Affected before 5.3.8.x1 Fixed in 5.3.8.x1 Patch available CNA
- Personal Cloud Storage T2 VendorLenovo Affected before 5.3.8.t2 Fixed in 5.3.8.t2 Patch available CNA
- Personal Cloud Storage T2Pro VendorLenovo Affected before 5.3.7.t2-pro Fixed in 5.3.7.t2-pro Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:a1_firmware:*:*:*:*:*:*:*:* | before 5.3.6.a1 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:a1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:t1_firmware:*:*:*:*:*:*:*:* | before 5.3.6.t1 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:t1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:x1_firmware:*:*:*:*:*:*:*:* | before 5.3.8.x1 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:x1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:t2_firmware:*:*:*:*:*:*:*:* | before 5.3.8.t2 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:t2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:t2pro_firmware:*:*:*:*:*:*:*:* | before 5.3.7.t2-pro | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:t2pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:a1_firmware:*:*:*:*:*:*:*:* Versions before 5.3.6.a1 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:a1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:t1_firmware:*:*:*:*:*:*:*:* Versions before 5.3.6.t1 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:t1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:x1_firmware:*:*:*:*:*:*:*:* Versions before 5.3.8.x1 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:t2_firmware:*:*:*:*:*:*:*:* Versions before 5.3.8.t2 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:t2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:t2pro_firmware:*:*:*:*:*:*:*:* Versions before 5.3.7.t2-pro Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:t2pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA Personal Cloud Storage A1 (Lenovo) Fixed in 5.3.6.a1
- Fix · CNA Personal Cloud Storage T1 (Lenovo) Fixed in 5.3.6.t1
- Fix · CNA Personal Cloud Storage X1 (Lenovo) Fixed in 5.3.8.x1
- Fix · CNA Personal Cloud Storage T2 (Lenovo) Fixed in 5.3.8.t2
- Fix · CNA Personal Cloud Storage T2Pro (Lenovo) Fixed in 5.3.7.t2-pro
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Lenovo Personal Cloud Storage A1, Personal Cloud Storage T1 and 3 more products 5.3.6.a1, 5.3.6.t1 and 3 more versions
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2021-19009 Hard-coded credentials in Lenovo Personal Cloud Storage A1Priority LOW 38
- TI-2021-19011 OS command injection in Lenovo Personal Cloud Storage A1Priority LOW 36
- TI-2021-19010 Missing authorization in Lenovo Personal Cloud Storage A1Priority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42849
- 2026-10-03 Alias added: GHSA-m656-2gwx-2qc9
References
More Lenovo A1 Firmware vulnerabilities
- TI-2021-19009 Hard-coded credentials in Lenovo Personal Cloud Storage A1 CVSS 3.1HIGH 8.8
- TI-2021-19011 OS command injection in Lenovo Personal Cloud Storage A1 CVSS 3.1HIGH 8.0
- TI-2021-19010 Missing authorization in Lenovo Personal Cloud Storage A1 CVSS 3.1MEDIUM 6.3
- TI-2021-19007 Missing authorization in Lenovo Personal Cloud Storage A1 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-42849 · CVE Program
- CVE-2021-42849 · NVD
- FIRST EPSS
- GHSA-m656-2gwx-2qc9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences