An improper certificate validation flaw (CWE-295) in the Lenovo FileZ application allows an attacker who can intercept network traffic to present a forged certificate that the app will accept. This defect enables arbitrary code execution on the device, compromising execution integrity and potentially granting full control of the system.

Both the Android and Windows editions of Lenovo FileZ are vulnerable. Lenovo recommends updating the Android app to version 11.1.0.35 or later and the Windows app to version 10.12.3.0 or later. Administrators should verify the installed version and apply these updates promptly.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a man‑in‑the‑middle or similar network interception scenario that permits the attacker to trigger the flaw without additional user interaction.