Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Lenovo Personal Cloud Storage A1, Personal Cloud Storage T1 and 3 more products 5.3.6.a1, 5.3.6.t1 and 3 more versions Clear all filters
TI-2021-19011 CVE-2021-42852 · GHSA-x2fg-f6p4-x5j3

OS command injection in Lenovo Personal Cloud Storage A1

Priority LOW 36

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00783 Published 2022-05-18 Fixed in 5.3.6.a1, 5.3.6.t1 +3 CWE-78
TI-2021-19010 CVE-2021-42851 · GHSA-r4g7-77xq-h6p2

Missing authorization in Lenovo Personal Cloud Storage A1

Priority LOW 29

A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.

CVSS 3.1MEDIUM 6.3 Adjacent network No auth No interaction EPSS 0.00596 Published 2022-05-18 Fixed in 5.3.6.a1, 5.3.6.t1 +3 CWE-862
TI-2021-19009 CVE-2021-42850 · GHSA-ch56-mgr4-g3m4

Hard-coded credentials in Lenovo Personal Cloud Storage A1

Priority LOW 38

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local net…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00243 Published 2022-05-18 Fixed in 5.3.6.a1, 5.3.6.t1 +3 CWE-798
TI-2021-19008 CVE-2021-42849 · GHSA-m656-2gwx-2qc9

Hard-coded credentials in Lenovo Personal Cloud Storage A1

Priority LOW 30

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.

CVSS 3.1MEDIUM 6.8 Physical No auth No interaction EPSS 0.00233 Published 2022-05-18 Fixed in 5.3.6.a1, 5.3.6.t1 +3 CWE-798
TI-2021-19007 CVE-2021-42848 · GHSA-2jhr-pq53-7pcf

Missing authorization in Lenovo Personal Cloud Storage A1

Priority LOW 25

An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00751 Published 2022-05-18 Fixed in 5.3.6.a1, 5.3.6.t1 +3 CWE-862