CVE-2021-42848 Information disclosure in Personal Cloud Storage A1

Medium 4.3 Published 18 May 2022 Updated 4 Aug 2024

Unauthenticated attackers can retrieve sensitive device and networking details from Lenovo Personal Cloud Storage devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-42848?

CVE-2021-42848 is a medium-severity vulnerability in Lenovo Personal Cloud Storage A1, published on 18 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.

Weakness: CWE-862

Which versions are affected by CVE-2021-42848?

It affects 5 products.

Products include Lenovo A1 Firmware, Lenovo T1 Firmware, Lenovo T2 Firmware, Lenovo T2pro Firmware, Lenovo X1 Firmware.

How do I fix CVE-2021-42848?

No fix has been published for CVE-2021-42848 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-42848 being exploited?

There is no known exploitation of CVE-2021-42848 in the wild and no public exploit code.

Sources

Also known as GHSA-2jhr-pq53-7pcf.