CVE-2021-42852

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

Score

CVSS 3.1 8.0 High

Status

Modified - psirt@lenovo.com

Published

2022-05-18

Last modified

2024-08-04

Weaknesses

CWE-78

Affected products

• A1 Firmware (Lenovo)
• Personal Cloud Storage A1 (Lenovo)
• Personal Cloud Storage T1 (Lenovo)
• Personal Cloud Storage T2 (Lenovo)
• Personal Cloud Storage T2pro (Lenovo)
• Personal Cloud Storage X1 (Lenovo)
• T1 Firmware (Lenovo)
• T2 Firmware (Lenovo)
• T2pro Firmware (Lenovo)
• X1 Firmware (Lenovo)

References

• https://iknow.lenovo.com.cn/detail/dc_200017.html