CVE-2021-42850: Lenovo a1 Firmware

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.

Affected products

• Lenovo a1 Firmware: before 5.3.6.a1 (fixed in 5.3.6.a1)
• Lenovo t1 Firmware: before 5.3.6.t1 (fixed in 5.3.6.t1)
• Lenovo t2 Firmware: before 5.3.8.t2 (fixed in 5.3.8.t2)
• Lenovo t2pro Firmware: before 5.3.7.t2-pro (fixed in 5.3.7.t2-pro)
• Lenovo x1 Firmware: before 5.3.8.x1 (fixed in 5.3.8.x1)

Published 2022-05-18. Last modified 2026-06-17.