Lenovo Personal Cloud Storage Improper File Path Validation Vulnerability Allowing Unauthorized File Access or Modification

A vulnerability allowing improper file path validation has been identified in certain Lenovo Personal Cloud Storage devices. This issue could enable a remote authenticated user to access or move files belonging to other users on the same device. The vulnerability arises from inadequate validation of file paths, potentially leading to unauthorized file manipulation.

Impact

Exploitation of this vulnerability could result in unauthorized access to or modification of files belonging to other users on the same device.

Remediation

Users can upgrade their device firmware to the latest version. For T2s, T2Pro, X1s, T20, and X20 models, the latest versions are available. For EOL models, it is recommended to enable 'LAN Secure Access' in the Lenovo Personal Cloud app to enhance security.