CVE-2021-42852: Lenovo a1 Firmware

High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days.

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.

Affected products

• Lenovo a1 Firmware: before 5.3.6.a1 (fixed in 5.3.6.a1)
• Lenovo t1 Firmware: before 5.3.6.t1 (fixed in 5.3.6.t1)
• Lenovo t2 Firmware: before 5.3.8.t2 (fixed in 5.3.8.t2)
• Lenovo t2pro Firmware: before 5.3.7.t2-pro (fixed in 5.3.7.t2-pro)
• Lenovo x1 Firmware: before 5.3.8.x1 (fixed in 5.3.8.x1)

Published 2022-05-18. Last modified 2026-06-17.