What’s Vulnerable › Vulnerabilities

CVE-2021-42850

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-18 · updated 2026-06-17
• Weakness: CWE-798

Description

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.

Affected products

• Lenovo A1 Firmware: before 5.3.6.a1 — fixed in 5.3.6.a1
• Lenovo T1 Firmware: before 5.3.6.t1 — fixed in 5.3.6.t1
• Lenovo T2 Firmware: before 5.3.8.t2 — fixed in 5.3.8.t2
• Lenovo T2Pro Firmware: before 5.3.7.t2-pro — fixed in 5.3.7.t2-pro
• Lenovo X1 Firmware: before 5.3.8.x1 — fixed in 5.3.8.x1

How to fix

Upgrade to a fixed version: Lenovo A1 Firmware 5.3.6.a1; Lenovo T1 Firmware 5.3.6.t1; Lenovo T2 Firmware 5.3.8.t2; Lenovo T2Pro Firmware 5.3.7.t2-pro; Lenovo X1 Firmware 5.3.8.x1. Check the vendor advisory for mitigations.

References

• https://iknow.lenovo.com.cn/detail/dc_200017.html
• https://iknow.lenovo.com.cn/detail/dc_200017.html

Get alerted when CVE-2021-42850 or the next vulnerability affects your stack