CVE-2026-89057 PUBLISHED

Assigner: lenovo
Reserved: 10.09.2026 Published: 15.10.2026 Updated: 15.10.2026

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

Metrics

CVSS Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7

Product Status

Vendor Lenovo
Product Idea Tab Pro (TB373FU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.107 (excl.)
Vendor Lenovo
Product Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.348 (excl.)
Vendor Lenovo
Product Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)
Versions Default: unaffected
  • affected from 0 to TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354 (excl.)
Vendor Lenovo
Product Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.354 (excl.)
Vendor Lenovo
Product Legion Tab (8.8", 3) (TB321FU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.319 (excl.)
Vendor Lenovo
Product Tab M11 (TB330FU)
Versions Default: unaffected
  • affected from 0 to 17.0.135 (excl.)
Vendor Lenovo
Product Tab M11 (TB330FU/TB330XU)
Versions Default: unaffected
  • affected from 0 to 17.0.517 (excl.)
Vendor Lenovo
Product Tab M11 (TB330XU)
Versions Default: unaffected
  • affected from 0 to 17.0.517 (excl.)
Vendor Lenovo
Product Tab Extreme (TB570FU)
Versions Default: unaffected
  • affected from 0 to 17.5.589 (excl.)
Vendor Lenovo
Product Tab Extreme (TB570ZU)
Versions Default: unaffected
  • affected from 0 to 17.5.589 (excl.)
Vendor Lenovo
Product Tab Extreme (TB570ZU/TB570FU)
Versions Default: unaffected
  • affected from 0 to 17.5.589 (excl.)
Vendor Lenovo
Product Tab K11 (TB330FUP)
Versions Default: unaffected
  • affected from 0 to 17.0.135 (excl.)
Vendor Lenovo
Product Tab K11 (TB330XUP)
Versions Default: unaffected
  • affected from 0 to 17.0.157 (excl.)
Vendor Lenovo
Product Tab K11 Plus (TB352FU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.344 (excl.)
Vendor Lenovo
Product Tab K11 Plus (TB352XU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.336 (excl.)
Vendor Lenovo
Product Tab K11 Plus LTE ROW (TB352XU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.336 (excl.)
Vendor Lenovo
Product Tab K11 Plus WIFI ROW: TB352FU
Versions Default: unaffected
  • affected from 0 to 17.0.10.344 (excl.)
Vendor Lenovo
Product Tab M10 5G (TB360ZU)
Versions Default: unaffected
  • affected from 0 to 16.0.939 (excl.)
Vendor Lenovo
Product Tab K9 (TB305FU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.324 (excl.)
Vendor Lenovo
Product Tab K9 (TB305XU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.318 (excl.)
Vendor Lenovo
Product Tab One (TB305FU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.324 (excl.)
Vendor Lenovo
Product Tab One (TB305XU)
Versions Default: unaffected
  • affected from 0 to 17.0.10.254 (excl.)
Vendor Lenovo
Product Tab P12 (TB370FU)
Versions Default: unaffected
  • affected from 0 to 17.0.352 (excl.)
Vendor Lenovo
Product Tab P12 (TB370FU/TB372FU)
Versions Default: unaffected
  • affected from 0 to TB370FU：17.0.352, TB372FC：17.0.223 (excl.)
Vendor Lenovo
Product Tab P12 (TB372FU)
Versions Default: unaffected
  • affected from 0 to 17.0.223 (excl.)
Vendor Lenovo
Product Tab Plus (TB351FU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.199 (excl.)
Vendor Lenovo
Product Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)
Versions Default: unaffected
  • affected from 0 to 17.5.36.417 (excl.)
Vendor Lenovo
Product Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)
Versions Default: unaffected
  • affected from 0 to TB311FU：17.5.36.417 ,TB311XU：17.5.37.350 (excl.)
Vendor Lenovo
Product Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)
Versions Default: unaffected
  • affected from 0 to 17.5.37.350 (excl.)
Vendor Lenovo
Product Yoga Tab (TB710FU)
Versions Default: unaffected
  • affected from 0 to 17.5.04.082 (excl.)
Vendor Lenovo
Product Yoga Tab Plus (TB520FU)
Versions Default: unaffected
  • affected from 0 to 17.5.10.362 (excl.)

Solutions

Update to the version (or higher) as recommended in the advisory - https://support.lenovo.com/us/en/product_security/LEN-218699

Credits

  • Lenovo thanks Deepak Toshniwal and Ayansh Toshniwal for reporting this issue. finder

References

Problem Types

  • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE