{"id":"CVE-2026-6281","state":"PUBLISHED","title":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands","description":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.","publishedAt":"2026-05-13T14:15:06.307Z","updatedAt":"2026-05-13T18:26:58.040Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"lenovo"},"assigner":"lenovo","products":["Lenovo Personal Cloud T2s","Lenovo Personal Cloud T2Pro","Lenovo Personal Cloud X1s","Lenovo Home Storage Hub T20","Lenovo Home Storage Hub X20","Lenovo Personal Cloud T1","Lenovo Personal Cloud A1","Lenovo Personal Cloud A1s","Lenovo Personal Cloud T2","Lenovo Personal Cloud X1"],"affected":[{"vendor":"Lenovo","product":"Personal Cloud T2s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.6.t2s.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.t2pro.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.x1s.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub T20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.8.t20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub X20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.4.x20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.0.t1.6","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.2.a1.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.5.6.a1s","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.5.t2.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.7.x1.1","versionType":"custom"}]}],"references":["https://iknow.lenovo.com.cn/detail/440274","https://pc.lenovo.com.cn/tips/Ann/t1_eol.html"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6281.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6281","state":"PUBLISHED","datePublished":"2026-05-13T14:15:06.307Z","dateUpdated":"2026-05-13T18:26:58.040Z","assignerShortName":"lenovo","assignerOrgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateReserved":"2026-04-14T14:42:10.223Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device."}],"affected":[{"vendor":"Lenovo","product":"Personal Cloud T2s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.6.t2s.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.t2pro.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.8.x1s.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub T20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.5.8.t20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Home Storage Hub X20","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.4.4.x20.1","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.0.t1.6","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.2.a1.3","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud A1s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.5.6.a1s","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud T2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.5.t2.2","versionType":"custom"}]},{"vendor":"Lenovo","product":"Personal Cloud X1","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.4.7.x1.1","versionType":"custom"}]}],"references":[{"url":"https://iknow.lenovo.com.cn/detail/440274"},{"url":"https://pc.lenovo.com.cn/tips/Ann/t1_eol.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command","type":"CWE"}]}],"providerMetadata":{"shortName":"lenovo","orgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateUpdated":"2026-05-13T14:15:06.307Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.5.6.t2s.3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2pro:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.8.t2pro.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_x1s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.8.x1s.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:home_storage_hub_t20:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.5.8.t20.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:home_storage_hub_x20:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.4.x20.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.0.t1.6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_a1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.2.a1.3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_a1s:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.5.6.a1s"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_t2:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.5.t2.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lenovo:personal_cloud_x1:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"5.4.7.x1.1"}]}]}],"solutions":[{"lang":"en","value":"Update device firmware to the version indicated in the advisory: https://iknow.lenovo.com.cn/detail/440274","supportingMedia":[{"type":"text/html","base64":false,"value":"Update device firmware to the version indicated in the advisory: https://iknow.lenovo.com.cn/detail/440274"}]}],"credits":[{"lang":"en","value":"Lenovo thanks Wang Jincheng, Professor Yu Le from Nanjing University of Posts and Telecommunications and Professor Luo Xiapu from The Hong Kong Polytechnic University","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.0-beta"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T18:26:41.674862Z","id":"CVE-2026-6281","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T18:26:58.040Z"}}]}}}