Read the docs
TI-2025-12846 Aliases CVE-2025-14058GHSA-frwg-fg7h-vg3h

Missing authentication in Lenovo Tab M11 TB330FU TB330XU

Priority LOW 12CWE-306Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed Tab M11 TB330FU TB330XU (Lenovo): 17.0.284Tab K11 TB330FU (Lenovo): 17.0.284+29 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoTab M11 TB330FU TB330XUbefore 17.0.28417.0.284Patch availableCNA
LenovoTab K11 TB330FUbefore 17.0.28417.0.284Patch availableCNA
LenovoTab K11 TB330FUPbefore 17.0.25417.0.254Patch availableCNA
LenovoTab K11 TB330XUbefore 17.0.08417.0.084Patch availableCNA
LenovoTab K11 TB330XUPbefore 17.0.25417.0.254Patch availableCNA
LenovoIdea Tab Pro TB373FUbefore ZUI_17.0.04.266_ST_251120ZUI_17.0.04.266_ST_251120Patch availableCNA
LenovoTab K9 TB305FUbefore 17.0.10.11817.0.10.118Patch availableCNA
LenovoTab K9 TB305XUbefore 17.0.10.09817.0.10.098Patch availableCNA
LenovoTab Plus TB351FUbefore 17.5.10.02317.5.10.023Patch availableCNA
LenovoTab M8 4th Gen 2024 TB301FUbefore TB301FU_USR_S000126_250919_MP1V1111_ROWTB301FU_USR_S000126_250919_MP1V1111_ROWPatch availableCNA
LenovoTab M8 4th Gen 2024 TB301XUbefore TB301XU_USR_S000147_250919_MP1V1111_ROWTB301XU_USR_S000147_250919_MP1V1111_ROWPatch availableCNA
LenovoTab Extreme TB570ZU TB570FUbefore 17.5.18417.5.184Patch availableCNA
LenovoTab M10 5G TB360ZUbefore 16.0.88216.0.882Patch availableCNA
LenovoTab M8 4th Gen TB300FUbefore TB300XU_USR_S100149_250919_MP1V1111_ROWTB300XU_USR_S100149_250919_MP1V1111_ROWPatch availableCNA
LenovoTab M8 4th Gen TB300XUbefore TB300FU_USR_S100122_250919_MP1V1111_ROWTB300FU_USR_S100122_250919_MP1V1111_ROWPatch availableCNA
LenovoTab M9 TB310FUbefore TB310XU_USR_S000913_2510021921_mp1V969_ROWTB310XU_USR_S000913_2510021921_mp1V969_ROWPatch availableCNA
LenovoTab M9 TB310XUbefore TB310FU_USR_S000912_2510022135_mp1V969_ROWTB310FU_USR_S000912_2510022135_mp1V969_ROWPatch availableCNA
LenovoTab P11 2nd Gen TB350XUbefore TB350FU_USER_S231044_2601050946TB350FU_USER_S231044_2601050946Patch availableCNA
LenovoTab P11 2nd Gen TB350FUbefore TB350XU_USER_S231018_2601050930TB350XU_USER_S231018_2601050930Patch availableCNA
LenovoTab P12 TB370FUbefore 17.0.26717.0.267Patch availableCNA
LenovoTab P12 TB372FUbefore 17.0.26717.0.267Patch availableCNA
LenovoTab K11 Plus LTE TB352FUbefore 17.0.10.25017.0.10.250Patch availableCNA
LenovoTab K11 Plus LTE TB352XUbefore 17.0.10.24217.0.10.242Patch availableCNA
LenovoYoga Tab Plus TB520FUbefore 17.5.10.03617.5.10.036Patch availableCNA
LenovoTab K11 Gen 2 TB336ZUbefore 17.0.10.54117.0.10.541Patch availableCNA
LenovoTAB7before 17.0.10.54117.0.10.541Patch availableCNA
LenovoLenovo Tab with Clear Case TB311FUbefore 17.0.30.30317.0.30.303Patch availableCNA
LenovoLenovo Tab with Folio Case TB311XUbefore 17.0.31.25917.0.31.259Patch availableCNA
LenovoLegion Tab TB321FUbefore 17.5.10.03117.5.10.031Patch availableCNA
LenovoLegion Tab TB320FCbefore 17.0.33917.0.339Patch availableCNA
LenovoIdea Tab TB336FUbefore 17.5.10.04117.5.10.041Patch availableCNA
  • Tab M11 TB330FU TB330XU VendorLenovo Affected before 17.0.284 Fixed in 17.0.284 Patch available CNA
  • Tab K11 TB330FU VendorLenovo Affected before 17.0.284 Fixed in 17.0.284 Patch available CNA
  • Tab K11 TB330FUP VendorLenovo Affected before 17.0.254 Fixed in 17.0.254 Patch available CNA
  • Tab K11 TB330XU VendorLenovo Affected before 17.0.084 Fixed in 17.0.084 Patch available CNA
  • Tab K11 TB330XUP VendorLenovo Affected before 17.0.254 Fixed in 17.0.254 Patch available CNA
  • Idea Tab Pro TB373FU VendorLenovo Affected before ZUI_17.0.04.266_ST_251120 Fixed in ZUI_17.0.04.266_ST_251120 Patch available CNA
  • Tab K9 TB305FU VendorLenovo Affected before 17.0.10.118 Fixed in 17.0.10.118 Patch available CNA
  • Tab K9 TB305XU VendorLenovo Affected before 17.0.10.098 Fixed in 17.0.10.098 Patch available CNA
  • Tab Plus TB351FU VendorLenovo Affected before 17.5.10.023 Fixed in 17.5.10.023 Patch available CNA
  • Tab M8 4th Gen 2024 TB301FU VendorLenovo Affected before TB301FU_USR_S000126_250919_MP1V1111_ROW Fixed in TB301FU_USR_S000126_250919_MP1V1111_ROW Patch available CNA
  • Tab M8 4th Gen 2024 TB301XU VendorLenovo Affected before TB301XU_USR_S000147_250919_MP1V1111_ROW Fixed in TB301XU_USR_S000147_250919_MP1V1111_ROW Patch available CNA
  • Tab Extreme TB570ZU TB570FU VendorLenovo Affected before 17.5.184 Fixed in 17.5.184 Patch available CNA
  • Tab M10 5G TB360ZU VendorLenovo Affected before 16.0.882 Fixed in 16.0.882 Patch available CNA
  • Tab M8 4th Gen TB300FU VendorLenovo Affected before TB300XU_USR_S100149_250919_MP1V1111_ROW Fixed in TB300XU_USR_S100149_250919_MP1V1111_ROW Patch available CNA
  • Tab M8 4th Gen TB300XU VendorLenovo Affected before TB300FU_USR_S100122_250919_MP1V1111_ROW Fixed in TB300FU_USR_S100122_250919_MP1V1111_ROW Patch available CNA
  • Tab M9 TB310FU VendorLenovo Affected before TB310XU_USR_S000913_2510021921_mp1V969_ROW Fixed in TB310XU_USR_S000913_2510021921_mp1V969_ROW Patch available CNA
  • Tab M9 TB310XU VendorLenovo Affected before TB310FU_USR_S000912_2510022135_mp1V969_ROW Fixed in TB310FU_USR_S000912_2510022135_mp1V969_ROW Patch available CNA
  • Tab P11 2nd Gen TB350XU VendorLenovo Affected before TB350FU_USER_S231044_2601050946 Fixed in TB350FU_USER_S231044_2601050946 Patch available CNA
  • Tab P11 2nd Gen TB350FU VendorLenovo Affected before TB350XU_USER_S231018_2601050930 Fixed in TB350XU_USER_S231018_2601050930 Patch available CNA
  • Tab P12 TB370FU VendorLenovo Affected before 17.0.267 Fixed in 17.0.267 Patch available CNA
  • Tab P12 TB372FU VendorLenovo Affected before 17.0.267 Fixed in 17.0.267 Patch available CNA
  • Tab K11 Plus LTE TB352FU VendorLenovo Affected before 17.0.10.250 Fixed in 17.0.10.250 Patch available CNA
  • Tab K11 Plus LTE TB352XU VendorLenovo Affected before 17.0.10.242 Fixed in 17.0.10.242 Patch available CNA
  • Yoga Tab Plus TB520FU VendorLenovo Affected before 17.5.10.036 Fixed in 17.5.10.036 Patch available CNA
  • Tab K11 Gen 2 TB336ZU VendorLenovo Affected before 17.0.10.541 Fixed in 17.0.10.541 Patch available CNA
  • TAB7 VendorLenovo Affected before 17.0.10.541 Fixed in 17.0.10.541 Patch available CNA
  • Lenovo Tab with Clear Case TB311FU VendorLenovo Affected before 17.0.30.303 Fixed in 17.0.30.303 Patch available CNA
  • Lenovo Tab with Folio Case TB311XU VendorLenovo Affected before 17.0.31.259 Fixed in 17.0.31.259 Patch available CNA
  • Legion Tab TB321FU VendorLenovo Affected before 17.5.10.031 Fixed in 17.5.10.031 Patch available CNA
  • Legion Tab TB320FC VendorLenovo Affected before 17.0.339 Fixed in 17.0.339 Patch available CNA
  • Idea Tab TB336FU VendorLenovo Affected before 17.5.10.041 Fixed in 17.5.10.041 Patch available CNA

Remediation

  • Fix · CNA Tab M11 TB330FU TB330XU (Lenovo) Fixed in 17.0.284
  • Fix · CNA Tab K11 TB330FU (Lenovo) Fixed in 17.0.284
  • Fix · CNA Tab K11 TB330FUP (Lenovo) Fixed in 17.0.254
  • Fix · CNA Tab K11 TB330XU (Lenovo) Fixed in 17.0.084
  • Fix · CNA Tab K11 TB330XUP (Lenovo) Fixed in 17.0.254
  • Fix · CNA Idea Tab Pro TB373FU (Lenovo) Fixed in ZUI_17.0.04.266_ST_251120
  • Fix · CNA Tab K9 TB305FU (Lenovo) Fixed in 17.0.10.118
  • Fix · CNA Tab K9 TB305XU (Lenovo) Fixed in 17.0.10.098
  • Fix · CNA Tab Plus TB351FU (Lenovo) Fixed in 17.5.10.023
  • Fix · CNA Tab M8 4th Gen 2024 TB301FU (Lenovo) Fixed in TB301FU_USR_S000126_250919_MP1V1111_ROW
  • Fix · CNA Tab M8 4th Gen 2024 TB301XU (Lenovo) Fixed in TB301XU_USR_S000147_250919_MP1V1111_ROW
  • Fix · CNA Tab Extreme TB570ZU TB570FU (Lenovo) Fixed in 17.5.184
  • Fix · CNA Tab M10 5G TB360ZU (Lenovo) Fixed in 16.0.882
  • Fix · CNA Tab M8 4th Gen TB300FU (Lenovo) Fixed in TB300XU_USR_S100149_250919_MP1V1111_ROW
  • Fix · CNA Tab M8 4th Gen TB300XU (Lenovo) Fixed in TB300FU_USR_S100122_250919_MP1V1111_ROW
  • Fix · CNA Tab M9 TB310FU (Lenovo) Fixed in TB310XU_USR_S000913_2510021921_mp1V969_ROW
  • Fix · CNA Tab M9 TB310XU (Lenovo) Fixed in TB310FU_USR_S000912_2510022135_mp1V969_ROW
  • Fix · CNA Tab P11 2nd Gen TB350XU (Lenovo) Fixed in TB350FU_USER_S231044_2601050946
  • Fix · CNA Tab P11 2nd Gen TB350FU (Lenovo) Fixed in TB350XU_USER_S231018_2601050930
  • Fix · CNA Tab P12 TB370FU (Lenovo) Fixed in 17.0.267
  • Fix · CNA Tab P12 TB372FU (Lenovo) Fixed in 17.0.267
  • Fix · CNA Tab K11 Plus LTE TB352FU (Lenovo) Fixed in 17.0.10.250
  • Fix · CNA Tab K11 Plus LTE TB352XU (Lenovo) Fixed in 17.0.10.242
  • Fix · CNA Yoga Tab Plus TB520FU (Lenovo) Fixed in 17.5.10.036
  • Fix · CNA Tab K11 Gen 2 TB336ZU (Lenovo) Fixed in 17.0.10.541
  • Fix · CNA TAB7 (Lenovo) Fixed in 17.0.10.541
  • Fix · CNA Lenovo Tab with Clear Case TB311FU (Lenovo) Fixed in 17.0.30.303
  • Fix · CNA Lenovo Tab with Folio Case TB311XU (Lenovo) Fixed in 17.0.31.259
  • Fix · CNA Legion Tab TB321FU (Lenovo) Fixed in 17.5.10.031
  • Fix · CNA Legion Tab TB320FC (Lenovo) Fixed in 17.0.339
  • Fix · CNA Idea Tab TB336FU (Lenovo) Fixed in 17.5.10.041

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14058
  2. 2026-10-03 Alias added: GHSA-frwg-fg7h-vg3h

References

Other 1

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences