CVE-2021-42851: Lenovo a1 Firmware

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.

Affected products

• Lenovo a1 Firmware: before 5.3.6.a1 (fixed in 5.3.6.a1)
• Lenovo t1 Firmware: before 5.3.6.t1 (fixed in 5.3.6.t1)
• Lenovo t2 Firmware: before 5.3.8.t2 (fixed in 5.3.8.t2)
• Lenovo t2pro Firmware: before 5.3.7.t2-pro (fixed in 5.3.7.t2-pro)
• Lenovo x1 Firmware: before 5.3.8.x1 (fixed in 5.3.8.x1)

Published 2022-05-18. Last modified 2026-06-17.