Read the docs
TI-2026-75109 Aliases CVE-2026-89057

Authentication bypass in Lenovo tablets allows physical device access

Priority LOW 32CWE-288Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

A potential authentication bypass flaw in some Lenovo tablets, tracked as CWE-288, lets a request skip the device's authentication checks through an alternate path or channel. A user with physical access to an affected tablet can gain unauthorized access to the device without privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed Idea Tab Pro (TB373FU) (Lenovo): 17.5.10.107Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) (Lenovo): 17.5.10.348+29 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIdea Tab Pro (TB373FU)before 17.5.10.10717.5.10.107Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)before 17.5.10.34817.5.10.348Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)before TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)before 17.5.10.35417.5.10.354Patch availableCNA
LenovoLegion Tab (8.8", 3) (TB321FU)before 17.5.10.31917.5.10.319Patch availableCNA
LenovoTab M11 (TB330FU)before 17.0.13517.0.135Patch availableCNA
LenovoTab M11 (TB330FU/TB330XU)before 17.0.51717.0.517Patch availableCNA
LenovoTab M11 (TB330XU)before 17.0.51717.0.517Patch availableCNA
LenovoTab Extreme (TB570FU)before 17.5.58917.5.589Patch availableCNA
LenovoTab Extreme (TB570ZU)before 17.5.58917.5.589Patch availableCNA
LenovoTab Extreme (TB570ZU/TB570FU)before 17.5.58917.5.589Patch availableCNA
LenovoTab K11 (TB330FUP)before 17.0.13517.0.135Patch availableCNA
LenovoTab K11 (TB330XUP)before 17.0.15717.0.157Patch availableCNA
LenovoTab K11 Plus (TB352FU)before 17.0.10.34417.0.10.344Patch availableCNA
LenovoTab K11 Plus (TB352XU)before 17.0.10.33617.0.10.336Patch availableCNA
LenovoTab K11 Plus LTE ROW (TB352XU)before 17.0.10.33617.0.10.336Patch availableCNA
LenovoTab K11 Plus WIFI ROW: TB352FUbefore 17.0.10.34417.0.10.344Patch availableCNA
LenovoTab M10 5G (TB360ZU)before 16.0.93916.0.939Patch availableCNA
LenovoTab K9 (TB305FU)before 17.0.10.32417.0.10.324Patch availableCNA
LenovoTab K9 (TB305XU)before 17.0.10.31817.0.10.318Patch availableCNA
LenovoTab One (TB305FU)before 17.0.10.32417.0.10.324Patch availableCNA
LenovoTab One (TB305XU)before 17.0.10.25417.0.10.254Patch availableCNA
LenovoTab P12 (TB370FU)before 17.0.35217.0.352Patch availableCNA
LenovoTab P12 (TB370FU/TB372FU)before TB370FU：17.0.352, TB372FC：17.0.223TB370FU：17.0.352, TB372FC：17.0.223Patch availableCNA
LenovoTab P12 (TB372FU)before 17.0.22317.0.223Patch availableCNA
LenovoTab Plus (TB351FU)before 17.5.10.19917.5.10.199Patch availableCNA
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)before 17.5.36.41717.5.36.417Patch availableCNA
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)before TB311FU：17.5.36.417 ,TB311XU：17.5.37.350TB311FU：17.5.36.417 ,TB311XU：17.5.37.350Patch availableCNA
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)before 17.5.37.35017.5.37.350Patch availableCNA
LenovoYoga Tab (TB710FU)before 17.5.04.08217.5.04.082Patch availableCNA
LenovoYoga Tab Plus (TB520FU)before 17.5.10.36217.5.10.362Patch availableCNA
  • Idea Tab Pro (TB373FU) VendorLenovo Affected before 17.5.10.107 Fixed in 17.5.10.107 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) VendorLenovo Affected before 17.5.10.348 Fixed in 17.5.10.348 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) VendorLenovo Affected before TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354 Fixed in TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) VendorLenovo Affected before 17.5.10.354 Fixed in 17.5.10.354 Patch available CNA
  • Legion Tab (8.8", 3) (TB321FU) VendorLenovo Affected before 17.5.10.319 Fixed in 17.5.10.319 Patch available CNA
  • Tab M11 (TB330FU) VendorLenovo Affected before 17.0.135 Fixed in 17.0.135 Patch available CNA
  • Tab M11 (TB330FU/TB330XU) VendorLenovo Affected before 17.0.517 Fixed in 17.0.517 Patch available CNA
  • Tab M11 (TB330XU) VendorLenovo Affected before 17.0.517 Fixed in 17.0.517 Patch available CNA
  • Tab Extreme (TB570FU) VendorLenovo Affected before 17.5.589 Fixed in 17.5.589 Patch available CNA
  • Tab Extreme (TB570ZU) VendorLenovo Affected before 17.5.589 Fixed in 17.5.589 Patch available CNA
  • Tab Extreme (TB570ZU/TB570FU) VendorLenovo Affected before 17.5.589 Fixed in 17.5.589 Patch available CNA
  • Tab K11 (TB330FUP) VendorLenovo Affected before 17.0.135 Fixed in 17.0.135 Patch available CNA
  • Tab K11 (TB330XUP) VendorLenovo Affected before 17.0.157 Fixed in 17.0.157 Patch available CNA
  • Tab K11 Plus (TB352FU) VendorLenovo Affected before 17.0.10.344 Fixed in 17.0.10.344 Patch available CNA
  • Tab K11 Plus (TB352XU) VendorLenovo Affected before 17.0.10.336 Fixed in 17.0.10.336 Patch available CNA
  • Tab K11 Plus LTE ROW (TB352XU) VendorLenovo Affected before 17.0.10.336 Fixed in 17.0.10.336 Patch available CNA
  • Tab K11 Plus WIFI ROW: TB352FU VendorLenovo Affected before 17.0.10.344 Fixed in 17.0.10.344 Patch available CNA
  • Tab M10 5G (TB360ZU) VendorLenovo Affected before 16.0.939 Fixed in 16.0.939 Patch available CNA
  • Tab K9 (TB305FU) VendorLenovo Affected before 17.0.10.324 Fixed in 17.0.10.324 Patch available CNA
  • Tab K9 (TB305XU) VendorLenovo Affected before 17.0.10.318 Fixed in 17.0.10.318 Patch available CNA
  • Tab One (TB305FU) VendorLenovo Affected before 17.0.10.324 Fixed in 17.0.10.324 Patch available CNA
  • Tab One (TB305XU) VendorLenovo Affected before 17.0.10.254 Fixed in 17.0.10.254 Patch available CNA
  • Tab P12 (TB370FU) VendorLenovo Affected before 17.0.352 Fixed in 17.0.352 Patch available CNA
  • Tab P12 (TB370FU/TB372FU) VendorLenovo Affected before TB370FU：17.0.352, TB372FC：17.0.223 Fixed in TB370FU：17.0.352, TB372FC：17.0.223 Patch available CNA
  • Tab P12 (TB372FU) VendorLenovo Affected before 17.0.223 Fixed in 17.0.223 Patch available CNA
  • Tab Plus (TB351FU) VendorLenovo Affected before 17.5.10.199 Fixed in 17.5.10.199 Patch available CNA
  • Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) VendorLenovo Affected before 17.5.36.417 Fixed in 17.5.36.417 Patch available CNA
  • Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) VendorLenovo Affected before TB311FU：17.5.36.417 ,TB311XU：17.5.37.350 Fixed in TB311FU：17.5.36.417 ,TB311XU：17.5.37.350 Patch available CNA
  • Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) VendorLenovo Affected before 17.5.37.350 Fixed in 17.5.37.350 Patch available CNA
  • Yoga Tab (TB710FU) VendorLenovo Affected before 17.5.04.082 Fixed in 17.5.04.082 Patch available CNA
  • Yoga Tab Plus (TB520FU) VendorLenovo Affected before 17.5.10.362 Fixed in 17.5.10.362 Patch available CNA

Remediation

Lenovo lists fixed firmware for affected tablets: Idea Tab Pro (TB373FU) 17.5.10.107, Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) 17.5.10.348, Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) 17.5.10.354, Legion Tab (8.8", 3) (TB321FU) 17.5.10.319, Tab M11 (TB330FU) 17.0.135, Tab M11 (TB330XU) 17.0.517, Tab Extreme (TB570FU) 17.5.589, Tab K11 Plus (TB352FU) 17.0.10.344, and other products with their own fixed versions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Idea Tab Pro (TB373FU) (Lenovo) Fixed in 17.5.10.107
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) (Lenovo) Fixed in 17.5.10.348
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) (Lenovo) Fixed in TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) (Lenovo) Fixed in 17.5.10.354
  • Fix · CNA Legion Tab (8.8", 3) (TB321FU) (Lenovo) Fixed in 17.5.10.319
  • Fix · CNA Tab M11 (TB330FU) (Lenovo) Fixed in 17.0.135
  • Fix · CNA Tab M11 (TB330FU/TB330XU) (Lenovo) Fixed in 17.0.517
  • Fix · CNA Tab M11 (TB330XU) (Lenovo) Fixed in 17.0.517
  • Fix · CNA Tab Extreme (TB570FU) (Lenovo) Fixed in 17.5.589
  • Fix · CNA Tab Extreme (TB570ZU) (Lenovo) Fixed in 17.5.589
  • Fix · CNA Tab Extreme (TB570ZU/TB570FU) (Lenovo) Fixed in 17.5.589
  • Fix · CNA Tab K11 (TB330FUP) (Lenovo) Fixed in 17.0.135
  • Fix · CNA Tab K11 (TB330XUP) (Lenovo) Fixed in 17.0.157
  • Fix · CNA Tab K11 Plus (TB352FU) (Lenovo) Fixed in 17.0.10.344
  • Fix · CNA Tab K11 Plus (TB352XU) (Lenovo) Fixed in 17.0.10.336
  • Fix · CNA Tab K11 Plus LTE ROW (TB352XU) (Lenovo) Fixed in 17.0.10.336
  • Fix · CNA Tab K11 Plus WIFI ROW: TB352FU (Lenovo) Fixed in 17.0.10.344
  • Fix · CNA Tab M10 5G (TB360ZU) (Lenovo) Fixed in 16.0.939
  • Fix · CNA Tab K9 (TB305FU) (Lenovo) Fixed in 17.0.10.324
  • Fix · CNA Tab K9 (TB305XU) (Lenovo) Fixed in 17.0.10.318
  • Fix · CNA Tab One (TB305FU) (Lenovo) Fixed in 17.0.10.324
  • Fix · CNA Tab One (TB305XU) (Lenovo) Fixed in 17.0.10.254
  • Fix · CNA Tab P12 (TB370FU) (Lenovo) Fixed in 17.0.352
  • Fix · CNA Tab P12 (TB370FU/TB372FU) (Lenovo) Fixed in TB370FU：17.0.352, TB372FC：17.0.223
  • Fix · CNA Tab P12 (TB372FU) (Lenovo) Fixed in 17.0.223
  • Fix · CNA Tab Plus (TB351FU) (Lenovo) Fixed in 17.5.10.199
  • Fix · CNA Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) (Lenovo) Fixed in 17.5.36.417
  • Fix · CNA Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) (Lenovo) Fixed in TB311FU：17.5.36.417 ,TB311XU：17.5.37.350
  • Fix · CNA Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) (Lenovo) Fixed in 17.5.37.350
  • Fix · CNA Yoga Tab (TB710FU) (Lenovo) Fixed in 17.5.04.082
  • Fix · CNA Yoga Tab Plus (TB520FU) (Lenovo) Fixed in 17.5.10.362

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo Tab K11 (TB330FUP), Tab K11 (TB330XUP) and 3 more products 17.0.135, 17.0.157 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-75112 Lenovo tablet flaw allows code execution after physical accessPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-89057
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences