← Back

CVE-2021-42850

nvd nist
Published: May 18, 2022Modified: Nov 21, 2024

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.

Affected (5)

Lenovo
5 products
A1 Firmware
T1 Firmware
X1 Firmware
T2 Firmware
T2pro Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
A1 Firmware
Before 5.3.6.a1
Running on/withPlatform Versions
Lenovo
A1
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T1 Firmware
Before 5.3.6.t1
Running on/withPlatform Versions
Lenovo
T1
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
X1 Firmware
Before 5.3.8.x1
Running on/withPlatform Versions
Lenovo
X1
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T2 Firmware
Before 5.3.8.t2
Running on/withPlatform Versions
Lenovo
T2
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T2pro Firmware
Before 5.3.7.t2-pro
Running on/withPlatform Versions
Lenovo
T2pro
All versions

Related CWEs

CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

Source: psirt@lenovo.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.