CVE-2026-6281

Remote Authenticated Command Injection Allowing Arbitrary Code Execution on Lenovo Personal Cloud Devices

View on CVE.org
Published May 13, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

Analysis

AI-generated

Technical impact

A remote authenticated local network user may execute arbitrary commands on affected Lenovo Home Storage Hub and Personal Cloud devices, exposing the system to total compromise. The flaw is a command injection vulnerability, identified as CWE‑78, that allows malicious code to run with device privileges, potentially leaking data, modifying configuration, or disrupting availability.

Affected Systems

Affected devices include Lenovo Home Storage Hub T20 and X20, and a range of Personal Cloud models such as A1, A1s, T1, T2, T2Pro, T2s, X1, and X1s. Firmware versions are unspecified; any device running older firmware is considered vulnerable.

Risk and Exploitability

The CVSS score of 8.7 signals high risk, while the EPSS score is currently unavailable, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV, but an adversary with local network access and authentication credentials could utilize the flaw. The attack requires compromise of a legitimate user account on the same network, emphasizing the need for segmentation and strong credential management.

Remediation

Vendor Solution

Update device firmware to the version indicated in the advisory: https://iknow.lenovo.com.cn/detail/440274

OpenCVE Recommended Actions

  • Apply the firmware update released by Lenovo, as specified in the advisory linked in the detailed article.
  • Configure network segmentation to isolate the device’s management interfaces from general local network traffic, limiting the reach of any compromised credentials.
  • Change default administrative passwords and enforce robust authentication policies to reduce the likelihood of credential reuse or brute force exploitation.

Generated by OpenCVE AI on May 13, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Remote Authenticated Command Injection Allowing Arbitrary Code Execution on Lenovo Personal Cloud Devices
Type Values Removed Values Added
Description A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.
First Time appeared Lenovo
Lenovo home Storage Hub T20
Lenovo home Storage Hub X20
Lenovo personal Cloud A1
Lenovo personal Cloud A1s
Lenovo personal Cloud T1
Lenovo personal Cloud T2
Lenovo personal Cloud T2pro
Lenovo personal Cloud T2s
Lenovo personal Cloud X1
Lenovo personal Cloud X1s
Weaknesses CWE-78
CPEs cpe:2.3:a:lenovo:home_storage_hub_t20:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:home_storage_hub_x20:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_a1:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_a1s:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_t1:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_t2:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_t2pro:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_t2s:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_x1:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:personal_cloud_x1s:*:*:*:*:*:*:*:*
Vendors & Products Lenovo
Lenovo home Storage Hub T20
Lenovo home Storage Hub X20
Lenovo personal Cloud A1
Lenovo personal Cloud A1s
Lenovo personal Cloud T1
Lenovo personal Cloud T2
Lenovo personal Cloud T2pro
Lenovo personal Cloud T2s
Lenovo personal Cloud X1
Lenovo personal Cloud X1s
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
lenovo
Published
Updated
May 13, 2026, 6:26 PM
Reserved
Apr 14, 2026, 2:42 PM

View source JSON

Updated
May 13, 2026, 6:26 PM

JSON

Status
Awaiting Analysis
Published
May 13, 2026, 4:17 PM
Modified
Oct 26, 2026, 5:10 PM

View source JSON

No data.

Updated
May 13, 2026, 6:15 PM

JSON