CVE-2021-42852

State: Published
Severity: 8.0 High
Published: May 18, 2022
Updated: Aug 4, 2024
Reserved: Oct 22, 2021

Description

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	lenovo

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
Personal Cloud Storage A1Lenovo	before 5.3.6.a1Affected
Personal Cloud Storage T1Lenovo	before 5.3.6.t1Affected
Personal Cloud Storage X1Lenovo	before 5.3.8.x1Affected
Personal Cloud Storage T2Lenovo	before 5.3.8.t2Affected
Personal Cloud Storage T2ProLenovo	before 5.3.7.t2-proAffected

References

https://iknow.lenovo.com.cn/detail/dc_200017.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.