CVE-2021-42850 : What You Need to Know

A weak default administrator password for some Lenovo Personal Cloud Storage devices could allow unauthorized access to attackers with physical or local network access.

Understanding CVE-2021-42850

What is CVE-2021-42850?

A weak default administrator password vulnerability was reported in Lenovo Personal Cloud Storage devices, potentially granting unauthorized access to attackers.

The Impact of CVE-2021-42850

The vulnerability has a CVSS base score of 8.8, with high impacts on confidentiality, integrity, and availability. Attackers with physical or local network access can exploit this issue.

Technical Details of CVE-2021-42850

Vulnerability Description

Vulnerability Type: CWE-798 Use of Hard-coded Credentials
Weak default administrator password for web interface and serial port

Affected Systems and Versions

Lenovo Personal Cloud Storage A1: < 5.3.6.a1
Lenovo Personal Cloud Storage T1: < 5.3.6.t1
Lenovo Personal Cloud Storage X1: < 5.3.8.x1
Lenovo Personal Cloud Storage T2: < 5.3.8.t2
Lenovo Personal Cloud Storage T2Pro: < 5.3.7.t2-pro

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Adjacent Network
Privileges Required: None
User Interaction: None
Scope: Unchanged

Mitigation and Prevention

Immediate Steps to Take

Update the Lenovo Personal Cloud Storage device firmware to versions specified in LEN-73439

Long-Term Security Practices

Regularly change default passwords and use strong, unique credentials
Implement network segmentation and access controls
Monitor device logs for unauthorized access

Patching and Updates

Ensure timely installation of security updates and patches