description: A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
product: Personal Cloud Storage A1
vendor: Lenovo
versions:
lessThan: 5.3.6.a1, status: affected, version: unspecified, versionType: custom
}
{
product: Personal Cloud Storage T1
vendor: Lenovo
versions:
lessThan: 5.3.6.t1, status: affected, version: unspecified, versionType: custom
}
{
product: Personal Cloud Storage X1
vendor: Lenovo
versions:
lessThan: 5.3.8.x1, status: affected, version: unspecified, versionType: custom
}
{
product: Personal Cloud Storage T2
vendor: Lenovo
versions:
lessThan: 5.3.8.t2, status: affected, version: unspecified, versionType: custom
}
{
product: Personal Cloud Storage T2Pro
vendor: Lenovo
versions:
lessThan: 5.3.7.t2-pro, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update to the Lenovo Personal Cloud Storage device firmware listed in the product table  in LEN-73439.