CVE-2021-42849

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798 CWE-287

Affected software

Vendor	Product	Versions
Lenovo	Personal Cloud Storage A1	>= unspecified, < 5.3.6.a1
Lenovo	Personal Cloud Storage T1	>= unspecified, < 5.3.6.t1
Lenovo	Personal Cloud Storage X1	>= unspecified, < 5.3.8.x1
Lenovo	Personal Cloud Storage T2	>= unspecified, < 5.3.8.t2
Lenovo	Personal Cloud Storage T2Pro	>= unspecified, < 5.3.7.t2-pro

References

https://iknow.lenovo.com.cn/detail/dc_200017.htmlVendor Advisory
https://iknow.lenovo.com.cn/detail/dc_200017.htmlVendor Advisory

Timeline

Published: May 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-42856.1A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templ CVE-2021-428507.8A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that CVE-2021-428515.3A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard use CVE-2021-428528.0A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execu CVE-2021-428539.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerabi CVE-2021-428549.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at CVE-2021-428557.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json stri CVE-2021-428566.1It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter CVE-2021-428575.3It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities a CVE-2021-428597.5A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some CVE-2021-42867.5A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculat CVE-2021-428607.5A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buff