← Back

CVE-2021-42849

nvd nist
Published: May 18, 2022Modified: Nov 21, 2024

JSON object

Loading...
6.8
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: NVD

Description

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.

Affected (5)

Lenovo
5 products
A1 Firmware
T1 Firmware
X1 Firmware
T2 Firmware
T2pro Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
A1 Firmware
Before 5.3.6.a1
Running on/withPlatform Versions
Lenovo
A1
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T1 Firmware
Before 5.3.6.t1
Running on/withPlatform Versions
Lenovo
T1
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
X1 Firmware
Before 5.3.8.x1
Running on/withPlatform Versions
Lenovo
X1
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T2 Firmware
Before 5.3.8.t2
Running on/withPlatform Versions
Lenovo
T2
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T2pro Firmware
Before 5.3.7.t2-pro
Running on/withPlatform Versions
Lenovo
T2pro
All versions

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

Source: psirt@lenovo.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.