CVE-2021-42852

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Lenovo	Personal Cloud Storage A1	>= unspecified, < 5.3.6.a1
Lenovo	Personal Cloud Storage T1	>= unspecified, < 5.3.6.t1
Lenovo	Personal Cloud Storage X1	>= unspecified, < 5.3.8.x1
Lenovo	Personal Cloud Storage T2	>= unspecified, < 5.3.8.t2
Lenovo	Personal Cloud Storage T2Pro	>= unspecified, < 5.3.7.t2-pro

References

https://iknow.lenovo.com.cn/detail/dc_200017.htmlVendor Advisory
https://iknow.lenovo.com.cn/detail/dc_200017.htmlVendor Advisory

Timeline

Published: May 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-428539.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerabi CVE-2021-428549.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at CVE-2021-428557.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json stri CVE-2021-428566.1It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter CVE-2021-428575.3It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities a CVE-2021-428597.5A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some CVE-2021-42867.5A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculat CVE-2021-428607.5A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buff CVE-2021-428639.8A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object CVE-2021-428664.8A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php CVE-2021-428674.8A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pa CVE-2021-428684.8A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/i