Lenovo a1 Firmware vulnerabilities

5 CVEs affecting Lenovo a1 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-42852, published 2022-05-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-42852, published 2022-05-18. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to…
CVE-2021-42848, published 2022-05-18. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
CVE-2021-42851, published 2022-05-18. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
CVE-2021-42850, published 2022-05-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with…
CVE-2021-42849, published 2022-05-18. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.