Read the docs
TI-2026-05507 Aliases CVE-2026-6281GHSA-q5wc-3rhr-ppvw

OS command injection in Lenovo Personal Cloud T2s

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix Fixed Personal Cloud T2s (Lenovo): 5.5.6.t2s.3Personal Cloud T2Pro (Lenovo): 5.4.8.t2pro.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoPersonal Cloud T2sbefore 5.5.6.t2s.35.5.6.t2s.3Patch availableCNA
LenovoPersonal Cloud T2Probefore 5.4.8.t2pro.25.4.8.t2pro.2Patch availableCNA
LenovoPersonal Cloud X1sbefore 5.4.8.x1s.25.4.8.x1s.2Patch availableCNA
LenovoHome Storage Hub T20before 5.5.8.t20.15.5.8.t20.1Patch availableCNA
LenovoHome Storage Hub X20before 5.4.4.x20.15.4.4.x20.1Patch availableCNA
LenovoPersonal Cloud T1up to 5.4.0.t1.6—No fix listedCNA
LenovoPersonal Cloud A1up to 5.4.2.a1.3—No fix listedCNA
LenovoPersonal Cloud A1sup to 5.5.6.a1s—No fix listedCNA
LenovoPersonal Cloud T2up to 5.4.5.t2.2—No fix listedCNA
LenovoPersonal Cloud X1up to 5.4.7.x1.1—No fix listedCNA
  • Personal Cloud T2s VendorLenovo Affected before 5.5.6.t2s.3 Fixed in 5.5.6.t2s.3 Patch available CNA
  • Personal Cloud T2Pro VendorLenovo Affected before 5.4.8.t2pro.2 Fixed in 5.4.8.t2pro.2 Patch available CNA
  • Personal Cloud X1s VendorLenovo Affected before 5.4.8.x1s.2 Fixed in 5.4.8.x1s.2 Patch available CNA
  • Home Storage Hub T20 VendorLenovo Affected before 5.5.8.t20.1 Fixed in 5.5.8.t20.1 Patch available CNA
  • Home Storage Hub X20 VendorLenovo Affected before 5.4.4.x20.1 Fixed in 5.4.4.x20.1 Patch available CNA
  • Personal Cloud T1 VendorLenovo Affected up to 5.4.0.t1.6 Fixed in — No fix listed CNA
  • Personal Cloud A1 VendorLenovo Affected up to 5.4.2.a1.3 Fixed in — No fix listed CNA
  • Personal Cloud A1s VendorLenovo Affected up to 5.5.6.a1s Fixed in — No fix listed CNA
  • Personal Cloud T2 VendorLenovo Affected up to 5.4.5.t2.2 Fixed in — No fix listed CNA
  • Personal Cloud X1 VendorLenovo Affected up to 5.4.7.x1.1 Fixed in — No fix listed CNA

Remediation

  • Fix · CNA Personal Cloud T2s (Lenovo) Fixed in 5.5.6.t2s.3
  • Fix · CNA Personal Cloud T2Pro (Lenovo) Fixed in 5.4.8.t2pro.2
  • Fix · CNA Personal Cloud X1s (Lenovo) Fixed in 5.4.8.x1s.2
  • Fix · CNA Home Storage Hub T20 (Lenovo) Fixed in 5.5.8.t20.1
  • Fix · CNA Home Storage Hub X20 (Lenovo) Fixed in 5.4.4.x20.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo Home Storage Hub T20, Home Storage Hub X20 and 3 more products 5.4.4.x20.1, 5.4.8.t2pro.2 and 3 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-05508 Path traversal in Lenovo Personal Cloud T2sPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6281
  2. 2026-10-03 Alias added: GHSA-q5wc-3rhr-ppvw
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 2

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences