CVE-2021-42849: Lenovo a1 Firmware

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.

Affected products

• Lenovo a1 Firmware: before 5.3.6.a1 (fixed in 5.3.6.a1)
• Lenovo t1 Firmware: before 5.3.6.t1 (fixed in 5.3.6.t1)
• Lenovo t2 Firmware: before 5.3.8.t2 (fixed in 5.3.8.t2)
• Lenovo t2pro Firmware: before 5.3.7.t2-pro (fixed in 5.3.7.t2-pro)
• Lenovo x1 Firmware: before 5.3.8.x1 (fixed in 5.3.8.x1)

Published 2022-05-18. Last modified 2026-06-17.