Description
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
Published: 2026-10-15
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Execute Arbitrary Code
Action: Apply Update
AI Analysis

Impact

A flaw in Lenovo tablets allows an attacker who has physical access to an unlocked device to bypass local security controls and run arbitrary code. The weakness is identified as CWE‑1394 and can give the attacker full control over the device, enabling data exfiltration, malware installation, and system modification.

Affected Systems

Affected Lenovo Tablet models include the Idea Tab Pro TB373FU, Idea Tab K11 Gen 2 variants (TB336FU, TB336ZU), Idea Tab K11 Plus (TB352FU, TB352XU, TB352XU LTE‑ROW, TB352FU WIFI‑ROW), Tab K9 (TB305FU, TB305XU), Tab M10 5G (TB360ZU), Tab M11 (TB330FU, TB330XU), Tab One (TB305FU, TB305XU), Tab P12 (TB370FU), Tab Plus (TB351FU), Legion Tab 8.8" (3) TB321FU, Tab Extreme TB570FU/TB570ZU, Tab K11 TB330FUP/TB330XUP, Tab K11 K12, Tab M10 5G, Tab M11, Tab One, Tab Plus, and Yoga Tab series (TB710FU, TB520FU).

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is less than 1%, and the vulnerability is not included in the CISA KEV catalog. The required attack vector is physical possession of an unlocked tablet, making it an in‑device, non‑network attack. If exploited, the attacker gains privileges sufficient to execute arbitrary code and compromise the entire device. Until the firmware update is applied, devices remain vulnerable.

Generated by OpenCVE AI on October 16, 2026 at 15:29 UTC.

Remediation

Vendor Solution

Update to the version (or newer) indicated for your model in the advisory - https://support.lenovo.com/us/en/product_security/LEN-221035

OpenCVE Recommended Actions

  • Install the Lenovo firmware update for your tablet model as provided at the Lenovo support link.
  • Enable a strong device lock—PIN, password, or biometric—to keep the tablet secured even when physically accessed.
  • Restrict physical access by storing the device in a locked environment or disabling unused removable media ports and ports that allow external media injection.

Generated by OpenCVE AI on October 16, 2026 at 15:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Title Physical-Access Bypass on Lenovo Tablets

Fri, 16 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Title Physical-Access Bypass on Lenovo Tablets

Thu, 15 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
First Time appeared Lenovo
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336fu
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336zu
Lenovo idea Tab Pro Tb373fu
Lenovo legion Tab 8.8 3 Tb321fu
Lenovo lenovo Tab With Clear Case Lenovo Tab With Folio Case Tb311fu Tb311xu
Lenovo tab Extreme Tb570fu
Lenovo tab Extreme Tb570zu Tb570fu
Lenovo tab K11 Plus Lte Row Tb352xu
Lenovo tab K11 Plus Tb352fu
Lenovo tab K11 Plus Tb352xu
Lenovo tab K11 Plus Wifi Row Tb352fu
Lenovo tab K11 Tb330fup
Lenovo tab K11 Tb330xup
Lenovo tab K9 Tb305fu
Lenovo tab K9 Tb305xu
Lenovo tab M10 5g Tb360zu
Lenovo tab M11 Tb330fu
Lenovo tab M11 Tb330xu
Lenovo tab One Tb305fu
Lenovo tab One Tb305xu
Lenovo tab P12 Tb370fu
Lenovo tab Plus Tb351fu
Lenovo tab With Clear Case Lenovo Tab With Folio Case Tb311fu
Lenovo tab With Clear Case Lenovo Tab With Folio Case Tb311xu
Lenovo yoga Tab Plus Tb520fu
Lenovo yoga Tab Tb710fu
Weaknesses CWE-1394
CPEs cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*
Vendors & Products Lenovo
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336fu
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu
Lenovo idea Tab Lenovo Tab K11 Gen 2 Tb336zu
Lenovo idea Tab Pro Tb373fu
Lenovo legion Tab 8.8 3 Tb321fu
Lenovo lenovo Tab With Clear Case Lenovo Tab With Folio Case Tb311fu Tb311xu
Lenovo tab Extreme Tb570fu
Lenovo tab Extreme Tb570zu Tb570fu
Lenovo tab K11 Plus Lte Row Tb352xu
Lenovo tab K11 Plus Tb352fu
Lenovo tab K11 Plus Tb352xu
Lenovo tab K11 Plus Wifi Row Tb352fu
Lenovo tab K11 Tb330fup
Lenovo tab K11 Tb330xup
Lenovo tab K9 Tb305fu
Lenovo tab K9 Tb305xu
Lenovo tab M10 5g Tb360zu
Lenovo tab M11 Tb330fu
Lenovo tab M11 Tb330xu
Lenovo tab One Tb305fu
Lenovo tab One Tb305xu
Lenovo tab P12 Tb370fu
Lenovo tab Plus Tb351fu
Lenovo tab With Clear Case Lenovo Tab With Folio Case Tb311fu
Lenovo tab With Clear Case Lenovo Tab With Folio Case Tb311xu
Lenovo yoga Tab Plus Tb520fu
Lenovo yoga Tab Tb710fu
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Lenovo Idea Tab Lenovo Tab K11 Gen 2 Tb336fu Idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu Idea Tab Lenovo Tab K11 Gen 2 Tb336zu Idea Tab Pro Tb373fu Legion Tab 8.8 3 Tb321fu Lenovo Tab With Clear Case Lenovo Tab With Folio Case Tb311fu Tb311xu Tab Extreme Tb570fu Tab Extreme Tb570zu Tb570fu Tab K11 Plus Lte Row Tb352xu Tab K11 Plus Tb352fu Tab K11 Plus Tb352xu Tab K11 Plus Wifi Row Tb352fu Tab K11 Tb330fup Tab K11 Tb330xup Tab K9 Tb305fu Tab K9 Tb305xu Tab M10 5g Tb360zu Tab M11 Tb330fu Tab M11 Tb330xu Tab One Tb305fu Tab One Tb305xu Tab P12 Tb370fu Tab Plus Tb351fu Tab With Clear Case Lenovo Tab With Folio Case Tb311fu Tab With Clear Case Lenovo Tab With Folio Case Tb311xu Yoga Tab Plus Tb520fu Yoga Tab Tb710fu
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-10-16T16:30:52.846Z

Reserved: 2026-09-16T19:20:40.312Z

Link: CVE-2026-92777

cve-icon Vulnrichment

Updated: 2026-10-16T16:30:43.250Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T00:17:07.333

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-92777

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T15:30:14Z

Weaknesses
  • CWE-1394

    Use of Default Cryptographic Key