An improper certificate validation vulnerability exists in Lenovo FileZ applications that permits an entity capable of intercepting network traffic to read sensitive user data transmitted by the application. The weakness is identified as CWE‑295 (Improper Certificate Validation) and effectively allows the attacker to obtain confidential information such as authentication credentials, session tokens, or other private data stored or sent within the application. This could lead to data compromise for the affected user(s).

The vulnerability affects Lenovo FileZ for both Android and Windows platforms. All installations prior to the patched releases are impacted. The vendor recommends updating the Android client to version 11.1.0.35 or newer and the Windows client to version 10.12.3.0 or newer.

The CVSS score of 6 indicates a medium severity risk. The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Exploitation would most likely involve a man‑in‑the‑middle (MITM) attack on the network path, requiring the attacker to intercept traffic between the device and the server. Successful exploitation would allow the intercepting user to view or extract sensitive data, compromising confidentiality for individual users.