CVE-2026-6281 | THREATINT

Description

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

PUBLISHED Reserved 2026-04-14 | Published 2026-05-13 | Updated 2026-05-13 | Assigner lenovo

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command

Product status

Default status

unaffected

Any version before 5.5.6.t2s.3

affected

Default status

unaffected

Any version before 5.4.8.t2pro.2

affected

Default status

unaffected

Any version before 5.4.8.x1s.2

affected

Default status

unaffected

Any version before 5.5.8.t20.1

affected

Default status

unaffected

Any version before 5.4.4.x20.1

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Credits

Lenovo thanks Wang Jincheng, Professor Yu Le from Nanjing University of Posts and Telecommunications and Professor Luo Xiapu from The Hong Kong Polytechnic University finder

References

iknow.lenovo.com.cn/detail/440274

pc.lenovo.com.cn/tips/Ann/t1_eol.html

cve.org (CVE-2026-6281)

nvd.nist.gov (CVE-2026-6281)

Download JSON