Read the docs
TI-2026-75112 Aliases CVE-2026-92777

Lenovo tablet flaw allows code execution after physical access

Priority LOW 25CWE-1394Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Several Lenovo tablets, including the Idea Tab Pro (TB373FU), Tab M11 (TB330FU) and other models, have a flaw involving a default cryptographic key (CWE-1394). A user with physical access to an unlocked tablet can bypass device protections and execute arbitrary code. Affected versions are those before the fixed versions listed in the solution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00147 3rd percentileScored 2026-11-07
Fix Fixed Idea Tab Pro (TB373FU) (Lenovo): 17.5.10.057Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) (Lenovo): 17.5.10.193+25 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIdea Tab Pro (TB373FU)before 17.5.10.05717.5.10.057Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)before 17.5.10.19317.5.10.193Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)before 17.5.10.21317.5.10.213Patch availableCNA
LenovoIdea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)before 17.5.10.21017.5.10.210Patch availableCNA
LenovoLegion Tab (8.8", 3) (TB321FU)before 17.5.10.17017.5.10.170Patch availableCNA
LenovoTab M11 (TB330FU)before 17.0.13517.0.135Patch availableCNA
LenovoTab M11 (TB330XU)before 17.0.51717.0.517Patch availableCNA
LenovoTab Extreme (TB570FU)before 17.5.38217.5.382Patch availableCNA
LenovoTab Extreme (TB570ZU/TB570FU)before 17.5.38217.5.382Patch availableCNA
LenovoTab K11 (TB330FUP)before 17.0.13517.0.135Patch availableCNA
LenovoTab K11 (TB330XUP)before 17.0.15717.0.157Patch availableCNA
LenovoTab K11 Plus (TB352FU)before 17.0.10.29617.0.10.296Patch availableCNA
LenovoTab K11 Plus (TB352XU)before 17.0.10.28417.0.10.284Patch availableCNA
LenovoTab K11 Plus LTE ROW (TB352XU)before 17.0.10.28417.0.10.284Patch availableCNA
LenovoTab K11 Plus WIFI ROW: TB352FUbefore 17.0.10.29617.0.10.296Patch availableCNA
LenovoTab M10 5G (TB360ZU)before 16.0.93516.0.935Patch availableCNA
LenovoTab K9 (TB305FU)before 17.0.10.21617.0.10.216Patch availableCNA
LenovoTab K9 (TB305XU)before 17.0.10.12917.0.10.129Patch availableCNA
LenovoTab One (TB305FU)before 17.0.10.21617.0.10.216Patch availableCNA
LenovoTab One (TB305XU)before 17.0.10.12917.0.10.129Patch availableCNA
LenovoTab P12 (TB370FU)before 17.0.28017.0.280Patch availableCNA
LenovoTab Plus (TB351FU)before 17.5.10.19917.5.10.199Patch availableCNA
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)before 17.5.36.30217.5.36.302Patch availableCNA
LenovoLenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)before 17.5.36.30217.5.36.302Patch availableCNA
LenovoTab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)before 17.5.37.21617.5.37.216Patch availableCNA
LenovoYoga Tab (TB710FU)before 17.5.04.05917.5.04.059Patch availableCNA
LenovoYoga Tab Plus (TB520FU)before 17.5.10.30917.5.10.309Patch availableCNA
  • Idea Tab Pro (TB373FU) VendorLenovo Affected before 17.5.10.057 Fixed in 17.5.10.057 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) VendorLenovo Affected before 17.5.10.193 Fixed in 17.5.10.193 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) VendorLenovo Affected before 17.5.10.213 Fixed in 17.5.10.213 Patch available CNA
  • Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) VendorLenovo Affected before 17.5.10.210 Fixed in 17.5.10.210 Patch available CNA
  • Legion Tab (8.8", 3) (TB321FU) VendorLenovo Affected before 17.5.10.170 Fixed in 17.5.10.170 Patch available CNA
  • Tab M11 (TB330FU) VendorLenovo Affected before 17.0.135 Fixed in 17.0.135 Patch available CNA
  • Tab M11 (TB330XU) VendorLenovo Affected before 17.0.517 Fixed in 17.0.517 Patch available CNA
  • Tab Extreme (TB570FU) VendorLenovo Affected before 17.5.382 Fixed in 17.5.382 Patch available CNA
  • Tab Extreme (TB570ZU/TB570FU) VendorLenovo Affected before 17.5.382 Fixed in 17.5.382 Patch available CNA
  • Tab K11 (TB330FUP) VendorLenovo Affected before 17.0.135 Fixed in 17.0.135 Patch available CNA
  • Tab K11 (TB330XUP) VendorLenovo Affected before 17.0.157 Fixed in 17.0.157 Patch available CNA
  • Tab K11 Plus (TB352FU) VendorLenovo Affected before 17.0.10.296 Fixed in 17.0.10.296 Patch available CNA
  • Tab K11 Plus (TB352XU) VendorLenovo Affected before 17.0.10.284 Fixed in 17.0.10.284 Patch available CNA
  • Tab K11 Plus LTE ROW (TB352XU) VendorLenovo Affected before 17.0.10.284 Fixed in 17.0.10.284 Patch available CNA
  • Tab K11 Plus WIFI ROW: TB352FU VendorLenovo Affected before 17.0.10.296 Fixed in 17.0.10.296 Patch available CNA
  • Tab M10 5G (TB360ZU) VendorLenovo Affected before 16.0.935 Fixed in 16.0.935 Patch available CNA
  • Tab K9 (TB305FU) VendorLenovo Affected before 17.0.10.216 Fixed in 17.0.10.216 Patch available CNA
  • Tab K9 (TB305XU) VendorLenovo Affected before 17.0.10.129 Fixed in 17.0.10.129 Patch available CNA
  • Tab One (TB305FU) VendorLenovo Affected before 17.0.10.216 Fixed in 17.0.10.216 Patch available CNA
  • Tab One (TB305XU) VendorLenovo Affected before 17.0.10.129 Fixed in 17.0.10.129 Patch available CNA
  • Tab P12 (TB370FU) VendorLenovo Affected before 17.0.280 Fixed in 17.0.280 Patch available CNA
  • Tab Plus (TB351FU) VendorLenovo Affected before 17.5.10.199 Fixed in 17.5.10.199 Patch available CNA
  • Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) VendorLenovo Affected before 17.5.36.302 Fixed in 17.5.36.302 Patch available CNA
  • Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) VendorLenovo Affected before 17.5.36.302 Fixed in 17.5.36.302 Patch available CNA
  • Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) VendorLenovo Affected before 17.5.37.216 Fixed in 17.5.37.216 Patch available CNA
  • Yoga Tab (TB710FU) VendorLenovo Affected before 17.5.04.059 Fixed in 17.5.04.059 Patch available CNA
  • Yoga Tab Plus (TB520FU) VendorLenovo Affected before 17.5.10.309 Fixed in 17.5.10.309 Patch available CNA

Remediation

Update each affected tablet to the fixed firmware for its model: 17.5.10.057 (Idea Tab Pro TB373FU), 17.5.10.170 (Legion Tab TB321FU), 17.5.10.193 (Idea Tab TB336FU), 17.5.10.210 (TB336ZU), 17.5.10.213 (TB336FU/TB336ZU), 17.5.382 (Tab Extreme TB570FU and TB570ZU/TB570FU), 17.0.135 (Tab M11 TB330FU and Tab K11 TB330FUP), 17.0.157 (Tab K11 TB330XUP), 17.0.517 (Tab M11 TB330XU), 17.0.10.284 (Tab K11 Plus TB352XU and LTE ROW TB352XU), and 17.0.10.296 (Tab K11 Plus TB352FU and WIFI ROW TB352FU).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Idea Tab Pro (TB373FU) (Lenovo) Fixed in 17.5.10.057
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) (Lenovo) Fixed in 17.5.10.193
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) (Lenovo) Fixed in 17.5.10.213
  • Fix · CNA Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) (Lenovo) Fixed in 17.5.10.210
  • Fix · CNA Legion Tab (8.8", 3) (TB321FU) (Lenovo) Fixed in 17.5.10.170
  • Fix · CNA Tab M11 (TB330FU) (Lenovo) Fixed in 17.0.135
  • Fix · CNA Tab M11 (TB330XU) (Lenovo) Fixed in 17.0.517
  • Fix · CNA Tab Extreme (TB570FU) (Lenovo) Fixed in 17.5.382
  • Fix · CNA Tab Extreme (TB570ZU/TB570FU) (Lenovo) Fixed in 17.5.382
  • Fix · CNA Tab K11 (TB330FUP) (Lenovo) Fixed in 17.0.135
  • Fix · CNA Tab K11 (TB330XUP) (Lenovo) Fixed in 17.0.157
  • Fix · CNA Tab K11 Plus (TB352FU) (Lenovo) Fixed in 17.0.10.296
  • Fix · CNA Tab K11 Plus (TB352XU) (Lenovo) Fixed in 17.0.10.284
  • Fix · CNA Tab K11 Plus LTE ROW (TB352XU) (Lenovo) Fixed in 17.0.10.284
  • Fix · CNA Tab K11 Plus WIFI ROW: TB352FU (Lenovo) Fixed in 17.0.10.296
  • Fix · CNA Tab M10 5G (TB360ZU) (Lenovo) Fixed in 16.0.935
  • Fix · CNA Tab K9 (TB305FU) (Lenovo) Fixed in 17.0.10.216
  • Fix · CNA Tab K9 (TB305XU) (Lenovo) Fixed in 17.0.10.129
  • Fix · CNA Tab One (TB305FU) (Lenovo) Fixed in 17.0.10.216
  • Fix · CNA Tab One (TB305XU) (Lenovo) Fixed in 17.0.10.129
  • Fix · CNA Tab P12 (TB370FU) (Lenovo) Fixed in 17.0.280
  • Fix · CNA Tab Plus (TB351FU) (Lenovo) Fixed in 17.5.10.199
  • Fix · CNA Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) (Lenovo) Fixed in 17.5.36.302
  • Fix · CNA Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) (Lenovo) Fixed in 17.5.36.302
  • Fix · CNA Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) (Lenovo) Fixed in 17.5.37.216
  • Fix · CNA Yoga Tab (TB710FU) (Lenovo) Fixed in 17.5.04.059
  • Fix · CNA Yoga Tab Plus (TB520FU) (Lenovo) Fixed in 17.5.10.309

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo Tab K11 (TB330FUP), Tab K11 (TB330XUP) and 3 more products 17.0.135, 17.0.157 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-75109 Authentication bypass in Lenovo tablets allows physical device accessPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-92777
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences