Search
Find a vulnerability
Search criteria
1239 vulnerabilities by Lenovo
CVE-2026-92777 (GCVE-0-2026-92777)
Vulnerability from nvd – Published: 2026-10-15 23:18 – Updated: 2026-10-16 16:30
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:30 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.057
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.193
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < 17.5.10.213
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.210
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.170
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.935
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.280
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.216
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.059
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.309
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:30:32.813048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:30:52.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.057",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.193",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.213",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.210",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.170",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.935",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.280",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.059",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.309",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.057",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.193",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.213",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.210",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.170",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.935",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.280",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.059",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.309",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Masayoshi Matsubara for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "PHYSICAL",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394: Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:18:01.762Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) indicated for your model in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"value": "Update to the version (or newer) indicated for your model in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-92777",
"datePublished": "2026-10-15T23:18:01.762Z",
"dateReserved": "2026-09-16T19:20:40.312Z",
"dateUpdated": "2026-10-16T16:30:52.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92629 (GCVE-0-2026-92629)
Vulnerability from nvd – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:00
VLAI
EPSS
VEX
Summary
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 13:58 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442628 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Baiying PC Client |
Affected:
0 , < 1.1.0.295
(custom)
cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T13:58:50.810807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:00:54.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "LenovoBaiyingCommercialAddin",
"product": "Baiying PC Client",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.1.0.295",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0.295",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market,\u0026nbsp;that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"value": "A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market,\u00a0that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:53.551Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442628"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate LenovoBaiyingCommercialAddin to version 1.1.0.295 or later.\u003c/p\u003e\u003cp\u003eThe LenovoBaiyingCommercialAddin updates automatically when the application launches.\u003c/p\u003e"
}
],
"value": "Update LenovoBaiyingCommercialAddin to version 1.1.0.295 or later.\n\nThe LenovoBaiyingCommercialAddin updates automatically when the application launches."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-92629",
"datePublished": "2026-10-15T23:17:53.551Z",
"dateReserved": "2026-09-16T15:44:14.918Z",
"dateUpdated": "2026-10-16T14:00:54.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89062 (GCVE-0-2026-89062)
Vulnerability from nvd – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:05
VLAI
EPSS
VEX
Summary
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:03 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Energy Management Driver |
Affected:
0 , < 15.11.30.14
(custom)
cpe:2.3:a:lenovo:energy_management_driver:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:03:42.798732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:05:04.916Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Energy Management Driver",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "15.11.30.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:energy_management_driver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.11.30.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks both Artemy Tsetsersky of Angara Security and Koh Tom Han, independent security researcher, for independently reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error."
}
],
"value": "A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:46.990Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) indicated for your model in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"value": "Update to the version (or newer) indicated for your model in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-89062",
"datePublished": "2026-10-15T23:17:46.990Z",
"dateReserved": "2026-09-10T18:31:23.916Z",
"dateUpdated": "2026-10-16T14:05:04.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89057 (GCVE-0-2026-89057)
Vulnerability from nvd – Published: 2026-10-15 23:17 – Updated: 2026-10-16 18:58
VLAI
EPSS
VEX
Summary
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:57 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
31 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.107
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.348
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.319
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU/TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.939
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.318
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.254
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.352
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU/TB372FU) |
Affected:
0 , < TB370FU：17.0.352, TB372FC：17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB372FU) |
Affected:
0 , < 17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.417
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < TB311FU：17.5.36.417 ,TB311XU：17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.082
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.362
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:50.385384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:58:59.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.107",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.348",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB336FU\uff1a17.5.10.348 ,TB336ZU\uff1a17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.319",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU/TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.939",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.318",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.254",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.352",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU/TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB370FU\uff1a17.0.352, TB372FC\uff1a17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.417",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB311FU\uff1a17.5.36.417 ,TB311XU\uff1a17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.082",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.362",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.107",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.348",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb336fu_17.5.10.348_tb336zu_17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.319",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.939",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.318",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.254",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.352",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb370fu_17.0.352_tb372fc_17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.417",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb311fu_17.5.36.417_tb311xu_17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.082",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.362",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Deepak Toshniwal and Ayansh Toshniwal for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:37.340Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or higher) as recommended in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"value": "Update to the version (or higher) as recommended in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-89057",
"datePublished": "2026-10-15T23:17:37.340Z",
"dateReserved": "2026-09-10T18:11:51.160Z",
"dateUpdated": "2026-10-16T18:58:59.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75941 (GCVE-0-2026-75941)
Vulnerability from nvd – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:07
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Legion Zone Application |
Affected:
0 , < 2.0.28.8182
(custom)
cpe:2.3:a:lenovo:legion_zone_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:06:57.367407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:07:12.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legion Zone Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "2.0.28.8182",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_zone_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.28.8182",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code."
}
],
"value": "A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:26.930Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/442627"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Legion Zone application to version 2.0.28.8182 or later."
}
],
"value": "Update Legion Zone application to version 2.0.28.8182 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-75941",
"datePublished": "2026-10-15T23:17:26.930Z",
"dateReserved": "2026-08-18T15:55:55.841Z",
"dateUpdated": "2026-10-16T14:07:12.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16755 (GCVE-0-2026-16755)
Vulnerability from nvd – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:08
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:07 UTC
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442625 | vendor-advisory |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Smart Camera C33 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C33 Pro |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C35 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera RQ3 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera XW1 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5E |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C5X |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X9T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:07:54.805524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:08:33.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33 Pro",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C35",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera RQ3",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera XW1",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5E",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C5X",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X9T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Tan Qingyin, Jin Chenghua, and Song Yuxin Key, Laboratory of Data and Intelligent System Security, Ministry of Education, China Nankai University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market,\u0026nbsp;that could allow an unauthorized remote user to disclose sensitive information."
}
],
"value": "A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market,\u00a0that could allow an unauthorized remote user to disclose sensitive information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393: Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:07.584Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442625"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update product to latest version as indicated in the advisory -\u0026nbsp;https://iknow.lenovo.com.cn/detail/442625"
}
],
"value": "Update product to latest version as indicated in the advisory -\u00a0https://iknow.lenovo.com.cn/detail/442625"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-16755",
"datePublished": "2026-10-15T23:17:07.584Z",
"dateReserved": "2026-07-23T13:06:49.749Z",
"dateUpdated": "2026-10-16T14:08:33.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16754 (GCVE-0-2026-16754)
Vulnerability from nvd – Published: 2026-10-15 23:16 – Updated: 2026-10-16 14:10
VLAI
EPSS
VEX
Summary
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:09 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442625 | vendor-advisory |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Smart Camera C33 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C33 Pro |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C35 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera RQ3 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera XW1 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5E |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C5X |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X9T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:09:28.760829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:10:12.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33 Pro",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C35",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera RQ3",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera XW1",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5E",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C5X",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X9T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Tan Qingyin, Jin Chenghua, and Song Yuxin Key, Laboratory of Data and Intelligent System Security, Ministry of Education, China Nankai University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications."
}
],
"value": "A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:16:59.545Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442625"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update product to latest version as indicated in the advisory -\u0026nbsp;https://iknow.lenovo.com.cn/detail/442625"
}
],
"value": "Update product to latest version as indicated in the advisory -\u00a0https://iknow.lenovo.com.cn/detail/442625"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-16754",
"datePublished": "2026-10-15T23:16:59.545Z",
"dateReserved": "2026-07-23T13:06:48.309Z",
"dateUpdated": "2026-10-16T14:10:12.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75940 (GCVE-0-2026-75940)
Vulnerability from nvd – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:50
VLAI
EPSS
VEX
Summary
A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:49 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442248 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Health Application |
Affected:
0 , ≤ 1.5.0
(custom)
cpe:2.3:a:lenovo:health_application:*:*:android:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:49:53.903558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:50:16.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "Health Application",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:health_application:*:*:android:*:*:*:*:*",
"versionEndExcluding": "1.5.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information."
}
],
"value": "A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:05.611Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442248"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Lenovo Health Android Application version to 1.5.0 or later."
}
],
"value": "Update Lenovo Health Android Application version to 1.5.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-75940",
"datePublished": "2026-09-10T21:00:05.611Z",
"dateReserved": "2026-08-18T15:55:52.564Z",
"dateUpdated": "2026-09-11T14:50:16.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63427 (GCVE-0-2026-63427)
Vulnerability from nvd – Published: 2026-09-10 21:00 – Updated: 2026-09-15 03:56
VLAI
EPSS
VEX
Summary
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 00:00 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/downloads/ds1012… | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Software Fix |
Affected:
0 , < 7.6.2.10
(custom)
cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T03:56:15.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Software Fix",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "7.6.2.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.2.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Quy Nguyen (@quynx9) for reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges."
}
],
"value": "An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:13.708Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-217409"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/downloads/ds101291-rescue-and-smart-assistant-lmsa"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Software Fix to version 7.6.2.10 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Software Fix to version 7.6.2.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63427",
"datePublished": "2026-09-10T21:00:13.708Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-09-15T03:56:15.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19136 (GCVE-0-2026-19136)
Vulnerability from nvd – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:48
VLAI
EPSS
VEX
Summary
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:48 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442249 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Tianxi AI Agent PC Application |
Affected:
0 , < 4.2.1.8111
(custom)
cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:48:22.703379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:48:37.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tianxi AI Agent PC Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "4.2.1.8111",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.1.8111",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application."
}
],
"value": "A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:19.351Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442249"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Tianxi AI Agent PC Application version to 4.2.1.8111 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Tianxi AI Agent PC Application version to 4.2.1.8111 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-19136",
"datePublished": "2026-09-10T21:00:19.351Z",
"dateReserved": "2026-08-06T16:32:34.925Z",
"dateUpdated": "2026-09-11T14:48:37.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18994 (GCVE-0-2026-18994)
Vulnerability from nvd – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:47
VLAI
EPSS
VEX
Summary
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:47 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442247 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | File Manager Application |
Affected:
0 , < 9.8.1.77
(custom)
cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:47:04.513864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:47:22.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "File Manager Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "9.8.1.77",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:*",
"versionEndExcluding": "9.8.1.77",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application."
}
],
"value": "A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926: Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:25.341Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442247"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo File Manager Android APP to Version 9.8.1.77 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo File Manager Android APP to Version 9.8.1.77 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-18994",
"datePublished": "2026-09-10T21:00:25.341Z",
"dateReserved": "2026-08-05T19:22:01.860Z",
"dateUpdated": "2026-09-11T14:47:22.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11813 (GCVE-0-2026-11813)
Vulnerability from nvd – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:46
VLAI
EPSS
VEX
Summary
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:46 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.filez.com/en/securityPolicy/5.html?17… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | FileZ Client |
Affected:
0 , < 11.7.1.0
(custom)
cpe:2.3:a:lenovo:filez_client:*:*:*:*:*:*:*:* |
|
| Lenovo | FileZ Enterprise |
Affected:
0 , < 11.5.1.0
(custom)
cpe:2.3:a:lenovo:filez_enterprise:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:46:34.529446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:46:47.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FileZ Client",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "11.7.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FileZ Enterprise",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "11.5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:filez_client:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.7.1.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:filez_enterprise:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.5.1.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Wanjie from Huazhong University of Science and Technology for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:31.582Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.filez.com/en/securityPolicy/5.html?1788882250"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Filez Windows Application Enterprise version to 11.5.1.0 or later."
}
],
"value": "Update Filez Windows Application Enterprise version to 11.5.1.0 or later."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Filez Windows Application version to 11.7.1.0 or later."
}
],
"value": "Update Filez Windows Application version to 11.7.1.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-11813",
"datePublished": "2026-09-10T21:00:31.582Z",
"dateReserved": "2026-06-09T15:53:47.545Z",
"dateUpdated": "2026-09-11T14:46:47.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6387 (GCVE-0-2026-6387)
Vulnerability from nvd – Published: 2026-08-13 14:52 – Updated: 2026-08-13 16:07
VLAI
EPSS
VEX
Summary
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 16:05 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/solutions/ht037099 | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | System Update |
Affected:
0 , < 5.08.04.85
(custom)
cpe:2.3:a:lenovo:system_update:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6387",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T16:05:56.673990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:07:44.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "System Update",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "5.08.04.85",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:system_update:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "5.08.04.85",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks sf0rn for reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eA potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:52:21.111Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-213316"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/solutions/ht037099"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo System Update to version 5.08.04.85 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo System Update to version 5.08.04.85 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-6387",
"datePublished": "2026-08-13T14:52:21.111Z",
"dateReserved": "2026-04-15T19:22:25.659Z",
"dateUpdated": "2026-08-13T16:07:44.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63426 (GCVE-0-2026-63426)
Vulnerability from nvd – Published: 2026-08-13 14:52 – Updated: 2026-08-13 15:59
VLAI
EPSS
VEX
Summary
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:58 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/solutions/ht037099#dm | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Dock Manager |
Affected:
0 , < 1.6.5.3
(custom)
cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:58:47.382728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:59:01.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dock Manager",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.6.5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.5.3",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges."
}
],
"value": "During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:52:38.123Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-223470"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/solutions/ht037099#dm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Dock Manager to version 1.6.5.3 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Dock Manager to version 1.6.5.3 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63426",
"datePublished": "2026-08-13T14:52:38.123Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-08-13T15:59:01.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63425 (GCVE-0-2026-63425)
Vulnerability from nvd – Published: 2026-08-13 14:52 – Updated: 2026-08-13 15:56
VLAI
EPSS
VEX
Summary
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:55 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/solutions/ht037099#dm | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Dock Manager |
Affected:
0 , < 1.6.5.3
(custom)
cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:55:58.499461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:56:19.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dock Manager",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.6.5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.5.3",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"value": "During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:52:45.399Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-223470"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/solutions/ht037099#dm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Lenovo Dock Manager to version 1.6.5.3 or later."
}
],
"value": "Update Lenovo Dock Manager to version 1.6.5.3 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63425",
"datePublished": "2026-08-13T14:52:45.399Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-08-13T15:56:19.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63424 (GCVE-0-2026-63424)
Vulnerability from nvd – Published: 2026-08-13 14:52 – Updated: 2026-08-13 15:55
VLAI
EPSS
VEX
Summary
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:55 UTC
CWE
- CWE-261 - Weak Encoding for Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/solutions/ht037099#dm | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Dock Manager |
Affected:
0 , < 1.6.5.3
(custom)
cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:55:23.870950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:55:32.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dock Manager",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.6.5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.5.3",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges."
}
],
"value": "During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-261",
"description": "CWE-261: Weak Encoding for Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:52:52.248Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-223470"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/solutions/ht037099#dm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Dock Manager to version 1.6.5.3 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Dock Manager to version 1.6.5.3 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63424",
"datePublished": "2026-08-13T14:52:52.248Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-08-13T15:55:32.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63423 (GCVE-0-2026-63423)
Vulnerability from nvd – Published: 2026-08-13 14:52 – Updated: 2026-08-13 15:55
VLAI
EPSS
VEX
Summary
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:54 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/downloads/ds568567 | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Accessories and Display Manager |
Affected:
0 , < 1.0.9
(custom)
cpe:2.3:a:lenovo:accessories_and_display_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:54:57.309404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:55:13.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Accessories and Display Manager",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:accessories_and_display_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.9",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"value": "During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321: Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:52:58.507Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-213038"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/downloads/ds568567"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Accessories and Display Manager for Enterprise for Windows to version 1.0.9 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Accessories and Display Manager for Enterprise for Windows to version 1.0.9 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63423",
"datePublished": "2026-08-13T14:52:58.507Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-08-13T15:55:13.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15994 (GCVE-0-2026-15994)
Vulnerability from nvd – Published: 2026-08-13 14:53 – Updated: 2026-08-13 15:54
VLAI
EPSS
VEX
Summary
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:54 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Commercial Vantage |
Affected:
0 , < 20.2026.20.0
(custom)
cpe:2.3:a:lenovo:commercial_vantage:*:*:*:*:*:*:*:* |
|
| Lenovo | Vantage |
Affected:
0 , < 10.2606.12
(custom)
cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:54:30.480264Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:54:43.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Commercial Vantage",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "20.2026.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vantage",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "10.2606.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:commercial_vantage:*:*:*:*:*:*:*:*",
"versionEndExcluding": "20.2026.20.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2606.12",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges."
}
],
"value": "During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:53:05.056Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-223723"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Commercial Vantage to version 20.2026.20.0 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Commercial Vantage to version 20.2026.20.0 or later."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Lenovo Vantage to version 10.2606.12 or later."
}
],
"value": "Update Lenovo Vantage to version 10.2606.12 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-15994",
"datePublished": "2026-08-13T14:53:05.056Z",
"dateReserved": "2026-07-16T21:04:52.830Z",
"dateUpdated": "2026-08-13T15:54:43.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92777 (GCVE-0-2026-92777)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:18 – Updated: 2026-10-16 16:30
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:30 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.057
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.193
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < 17.5.10.213
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.210
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.170
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.935
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.280
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.216
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.059
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.309
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:30:32.813048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:30:52.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.057",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.193",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.213",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.210",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.170",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.935",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.280",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.059",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.309",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.057",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.193",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.213",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.210",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.170",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.935",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.280",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.059",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.309",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Masayoshi Matsubara for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "PHYSICAL",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394: Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:18:01.762Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) indicated for your model in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"value": "Update to the version (or newer) indicated for your model in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-92777",
"datePublished": "2026-10-15T23:18:01.762Z",
"dateReserved": "2026-09-16T19:20:40.312Z",
"dateUpdated": "2026-10-16T16:30:52.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92629 (GCVE-0-2026-92629)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:00
VLAI
EPSS
VEX
Summary
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 13:58 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442628 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Baiying PC Client |
Affected:
0 , < 1.1.0.295
(custom)
cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T13:58:50.810807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:00:54.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "LenovoBaiyingCommercialAddin",
"product": "Baiying PC Client",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "1.1.0.295",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0.295",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market,\u0026nbsp;that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"value": "A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market,\u00a0that could allow a local authenticated user to execute arbitrary code with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:53.551Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442628"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate LenovoBaiyingCommercialAddin to version 1.1.0.295 or later.\u003c/p\u003e\u003cp\u003eThe LenovoBaiyingCommercialAddin updates automatically when the application launches.\u003c/p\u003e"
}
],
"value": "Update LenovoBaiyingCommercialAddin to version 1.1.0.295 or later.\n\nThe LenovoBaiyingCommercialAddin updates automatically when the application launches."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-92629",
"datePublished": "2026-10-15T23:17:53.551Z",
"dateReserved": "2026-09-16T15:44:14.918Z",
"dateUpdated": "2026-10-16T14:00:54.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89062 (GCVE-0-2026-89062)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:05
VLAI
EPSS
VEX
Summary
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:03 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Energy Management Driver |
Affected:
0 , < 15.11.30.14
(custom)
cpe:2.3:a:lenovo:energy_management_driver:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:03:42.798732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:05:04.916Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Energy Management Driver",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "15.11.30.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:energy_management_driver:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.11.30.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks both Artemy Tsetsersky of Angara Security and Koh Tom Han, independent security researcher, for independently reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error."
}
],
"value": "A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:46.990Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) indicated for your model in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"value": "Update to the version (or newer) indicated for your model in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-218444"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-89062",
"datePublished": "2026-10-15T23:17:46.990Z",
"dateReserved": "2026-09-10T18:31:23.916Z",
"dateUpdated": "2026-10-16T14:05:04.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89057 (GCVE-0-2026-89057)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 18:58
VLAI
EPSS
VEX
Summary
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:57 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
31 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.107
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.348
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.319
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU/TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.939
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.318
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.254
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.352
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU/TB372FU) |
Affected:
0 , < TB370FU：17.0.352, TB372FC：17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB372FU) |
Affected:
0 , < 17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.417
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < TB311FU：17.5.36.417 ,TB311XU：17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.082
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.362
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:50.385384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:58:59.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.107",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.348",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB336FU\uff1a17.5.10.348 ,TB336ZU\uff1a17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.319",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU/TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.939",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.318",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.254",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.352",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU/TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB370FU\uff1a17.0.352, TB372FC\uff1a17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.417",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB311FU\uff1a17.5.36.417 ,TB311XU\uff1a17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.082",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.362",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.107",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.348",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb336fu_17.5.10.348_tb336zu_17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.319",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.939",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.318",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.254",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.352",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb370fu_17.0.352_tb372fc_17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.417",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb311fu_17.5.36.417_tb311xu_17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.082",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.362",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Deepak Toshniwal and Ayansh Toshniwal for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:37.340Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or higher) as recommended in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"value": "Update to the version (or higher) as recommended in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-89057",
"datePublished": "2026-10-15T23:17:37.340Z",
"dateReserved": "2026-09-10T18:11:51.160Z",
"dateUpdated": "2026-10-16T18:58:59.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75941 (GCVE-0-2026-75941)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:07
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:06 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Legion Zone Application |
Affected:
0 , < 2.0.28.8182
(custom)
cpe:2.3:a:lenovo:legion_zone_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:06:57.367407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:07:12.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legion Zone Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "2.0.28.8182",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_zone_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.28.8182",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code."
}
],
"value": "A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:26.930Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/442627"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Legion Zone application to version 2.0.28.8182 or later."
}
],
"value": "Update Legion Zone application to version 2.0.28.8182 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-75941",
"datePublished": "2026-10-15T23:17:26.930Z",
"dateReserved": "2026-08-18T15:55:55.841Z",
"dateUpdated": "2026-10-16T14:07:12.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16755 (GCVE-0-2026-16755)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 14:08
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:07 UTC
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442625 | vendor-advisory |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Smart Camera C33 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C33 Pro |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C35 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera RQ3 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera XW1 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5E |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C5X |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X9T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:07:54.805524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:08:33.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33 Pro",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C35",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera RQ3",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera XW1",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5E",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C5X",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X9T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Tan Qingyin, Jin Chenghua, and Song Yuxin Key, Laboratory of Data and Intelligent System Security, Ministry of Education, China Nankai University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market,\u0026nbsp;that could allow an unauthorized remote user to disclose sensitive information."
}
],
"value": "A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market,\u00a0that could allow an unauthorized remote user to disclose sensitive information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393: Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:07.584Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442625"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update product to latest version as indicated in the advisory -\u0026nbsp;https://iknow.lenovo.com.cn/detail/442625"
}
],
"value": "Update product to latest version as indicated in the advisory -\u00a0https://iknow.lenovo.com.cn/detail/442625"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-16755",
"datePublished": "2026-10-15T23:17:07.584Z",
"dateReserved": "2026-07-23T13:06:49.749Z",
"dateUpdated": "2026-10-16T14:08:33.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16754 (GCVE-0-2026-16754)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:16 – Updated: 2026-10-16 14:10
VLAI
EPSS
VEX
Summary
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:09 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442625 | vendor-advisory |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Smart Camera C33 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C33 Pro |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C35 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera RQ3 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera XW1 |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Network PTZ X5E |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X6Q |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera C5X |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:* |
|
| Lenovo | Smart Camera X9T |
Affected:
0 , < 05.02.31.140
(custom)
cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:09:28.760829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:10:12.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C33 Pro",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C35",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera RQ3",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera XW1",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Network PTZ X5E",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X6Q",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera C5X",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart Camera X9T",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "05.02.31.140",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c33_pro:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c35:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_rq3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_xw1:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_network_ptz_x5e:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x6q:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_c5x:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:smart_camera_x9t:*:*:*:*:*:*:*:*",
"versionEndExcluding": "05.02.31.140",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Tan Qingyin, Jin Chenghua, and Song Yuxin Key, Laboratory of Data and Intelligent System Security, Ministry of Education, China Nankai University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications."
}
],
"value": "A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:16:59.545Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442625"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update product to latest version as indicated in the advisory -\u0026nbsp;https://iknow.lenovo.com.cn/detail/442625"
}
],
"value": "Update product to latest version as indicated in the advisory -\u00a0https://iknow.lenovo.com.cn/detail/442625"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-16754",
"datePublished": "2026-10-15T23:16:59.545Z",
"dateReserved": "2026-07-23T13:06:48.309Z",
"dateUpdated": "2026-10-16T14:10:12.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11813 (GCVE-0-2026-11813)
Vulnerability from cvelistv5 – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:46
VLAI
EPSS
VEX
Summary
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:46 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.filez.com/en/securityPolicy/5.html?17… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | FileZ Client |
Affected:
0 , < 11.7.1.0
(custom)
cpe:2.3:a:lenovo:filez_client:*:*:*:*:*:*:*:* |
|
| Lenovo | FileZ Enterprise |
Affected:
0 , < 11.5.1.0
(custom)
cpe:2.3:a:lenovo:filez_enterprise:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:46:34.529446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:46:47.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FileZ Client",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "11.7.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FileZ Enterprise",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "11.5.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:filez_client:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.7.1.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:filez_enterprise:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.5.1.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Wanjie from Huazhong University of Science and Technology for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:31.582Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.filez.com/en/securityPolicy/5.html?1788882250"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Filez Windows Application Enterprise version to 11.5.1.0 or later."
}
],
"value": "Update Filez Windows Application Enterprise version to 11.5.1.0 or later."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Filez Windows Application version to 11.7.1.0 or later."
}
],
"value": "Update Filez Windows Application version to 11.7.1.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-11813",
"datePublished": "2026-09-10T21:00:31.582Z",
"dateReserved": "2026-06-09T15:53:47.545Z",
"dateUpdated": "2026-09-11T14:46:47.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18994 (GCVE-0-2026-18994)
Vulnerability from cvelistv5 – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:47
VLAI
EPSS
VEX
Summary
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:47 UTC
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442247 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | File Manager Application |
Affected:
0 , < 9.8.1.77
(custom)
cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:47:04.513864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:47:22.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "File Manager Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "9.8.1.77",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:*",
"versionEndExcluding": "9.8.1.77",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application."
}
],
"value": "A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "CWE-926: Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:25.341Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442247"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo File Manager Android APP to Version 9.8.1.77 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo File Manager Android APP to Version 9.8.1.77 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-18994",
"datePublished": "2026-09-10T21:00:25.341Z",
"dateReserved": "2026-08-05T19:22:01.860Z",
"dateUpdated": "2026-09-11T14:47:22.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19136 (GCVE-0-2026-19136)
Vulnerability from cvelistv5 – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:48
VLAI
EPSS
VEX
Summary
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:48 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442249 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Tianxi AI Agent PC Application |
Affected:
0 , < 4.2.1.8111
(custom)
cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:48:22.703379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:48:37.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tianxi AI Agent PC Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "4.2.1.8111",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.1.8111",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application."
}
],
"value": "A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:19.351Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442249"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Tianxi AI Agent PC Application version to 4.2.1.8111 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Tianxi AI Agent PC Application version to 4.2.1.8111 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-19136",
"datePublished": "2026-09-10T21:00:19.351Z",
"dateReserved": "2026-08-06T16:32:34.925Z",
"dateUpdated": "2026-09-11T14:48:37.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63427 (GCVE-0-2026-63427)
Vulnerability from cvelistv5 – Published: 2026-09-10 21:00 – Updated: 2026-09-15 03:56
VLAI
EPSS
VEX
Summary
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 00:00 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
| https://support.lenovo.com/us/en/downloads/ds1012… | productpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Software Fix |
Affected:
0 , < 7.6.2.10
(custom)
cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T03:56:15.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Software Fix",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "7.6.2.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.2.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Quy Nguyen (@quynx9) for reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges."
}
],
"value": "An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:13.708Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-217409"
},
{
"tags": [
"product",
"patch"
],
"url": "https://support.lenovo.com/us/en/downloads/ds101291-rescue-and-smart-assistant-lmsa"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eUpdate Lenovo Software Fix to version 7.6.2.10 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Update Lenovo Software Fix to version 7.6.2.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-63427",
"datePublished": "2026-09-10T21:00:13.708Z",
"dateReserved": "2026-07-16T19:22:22.180Z",
"dateUpdated": "2026-09-15T03:56:15.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75940 (GCVE-0-2026-75940)
Vulnerability from cvelistv5 – Published: 2026-09-10 21:00 – Updated: 2026-09-11 14:50
VLAI
EPSS
VEX
Summary
A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:49 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/442248 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Health Application |
Affected:
0 , ≤ 1.5.0
(custom)
cpe:2.3:a:lenovo:health_application:*:*:android:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:49:53.903558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:50:16.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "Health Application",
"vendor": "Lenovo",
"versions": [
{
"lessThanOrEqual": "1.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:health_application:*:*:android:*:*:*:*:*",
"versionEndExcluding": "1.5.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information."
}
],
"value": "A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T21:00:05.611Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/442248"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Lenovo Health Android Application version to 1.5.0 or later."
}
],
"value": "Update Lenovo Health Android Application version to 1.5.0 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-75940",
"datePublished": "2026-09-10T21:00:05.611Z",
"dateReserved": "2026-08-18T15:55:52.564Z",
"dateUpdated": "2026-09-11T14:50:16.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}