# CVE-2026-6281: Lenovo Personal Cloud Storage OS command injection

Source: https://junglewise.ai/threats/cve-2026-6281-lenovo-personal-cloud-storage-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6281 · Severity: high · CVSS 8.8 · Published 2026-05-13

A security vulnerability has been identified in several Lenovo Personal Cloud Storage devices, which are used by consumers to store and manage files at home. An attacker who has already gained access to the local network and has a valid user account can take full control of the device. This could lead to the theft of private data, deletion of files, or the device being used as a foothold for further attacks on the home network.

Vendors: [Lenovo](https://junglewise.ai/threats/vendors/lenovo).

## Quick answers

**Is CVE-2026-6281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6281 being exploited in the wild.

**How severe is CVE-2026-6281?** High severity, with a CVSS score of 8.8, published 13 May 2026.

**Which products and versions are affected?** Lenovo Personal Cloud Storage T1 (L-SSC201-*); Lenovo Personal Cloud Storage A1 (L-SSC101/L-SSC121); Lenovo Personal Cloud Storage X1 (L-SSC501-*); Lenovo Personal Cloud Storage T2 (L-SSC202-*); and 1 more.

**Is there a fix for CVE-2026-6281?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6281 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6281?** Check whether you run Lenovo Personal Cloud Storage A1, Lenovo Personal Cloud Storage A1s, Lenovo Personal Cloud Storage T1 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-78) exists in multiple Lenovo Personal Cloud Storage models, including the T1, A1, X1, T2, and A1s series. The flaw allows a remote authenticated attacker on the same local network to execute arbitrary OS commands on the device. This is caused by improper neutralization of special elements used in an OS command. While the vulnerability requires authentication, the impact is high as it allows for full system compromise. Notably, Lenovo has declared these specific models as End of Life (EOL) and has stated they will no longer receive security firmware updates, meaning no official patch is expected.

## Affected products

- Lenovo Personal Cloud Storage T1 (L-SSC201-*)
- Lenovo Personal Cloud Storage A1 (L-SSC101/L-SSC121)
- Lenovo Personal Cloud Storage X1 (L-SSC501-*)
- Lenovo Personal Cloud Storage T2 (L-SSC202-*)
- Lenovo Personal Cloud Storage A1s (L-SSC103-*)

## Timeline

- 2026-04-20: other: Lenovo issues EOL notice for affected models
- 2026-05-13: disclosed: Vulnerability details published via NVD

## References

- [https://iknow.lenovo.com.cn/detail/440274](https://iknow.lenovo.com.cn/detail/440274)
- [https://pc.lenovo.com.cn/tips/Ann/t1_eol.html](https://pc.lenovo.com.cn/tips/Ann/t1_eol.html)

## Related threats

- [Lenovo Personal Cloud Storage path traversal in file management](https://junglewise.ai/threats/cve-2026-6282-lenovo-personal-cloud-storage-path-traversal-in-file-management)