CVE-2026-89057
Summary
| CVE | CVE-2026-89057 |
|---|---|
| State | PUBLISHED |
| Assigner | lenovo |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-16 00:17:06 UTC |
| Updated | 2026-10-16 19:55:59 UTC |
| Description | A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access. |
Risk And Classification
Primary CVSS: v4.0 7 HIGH from [email protected]
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002940000 probability, percentile 0.206080000 (date 2026-10-16)
Problem Types: CWE-288 | CWE-288 CWE-288: Authentication Bypass Using an Alternate Path or Channel
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7 | HIGH | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7 | HIGH | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 6.8 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 6.8 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
PhysicalAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
PhysicalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Lenovo | Idea Tab Pro TB373FU | affected 17.5.10.107 custom | Not specified |
| CNA | Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 TB336FU | affected 17.5.10.348 custom | Not specified |
| CNA | Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 TB336FU/TB336ZU | affected TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354 custom | Not specified |
| CNA | Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 TB336ZU | affected 17.5.10.354 custom | Not specified |
| CNA | Lenovo | Legion Tab 8.8 3 TB321FU | affected 17.5.10.319 custom | Not specified |
| CNA | Lenovo | Tab M11 TB330FU | affected 17.0.135 custom | Not specified |
| CNA | Lenovo | Tab M11 TB330FU/TB330XU | affected 17.0.517 custom | Not specified |
| CNA | Lenovo | Tab M11 TB330XU | affected 17.0.517 custom | Not specified |
| CNA | Lenovo | Tab Extreme TB570FU | affected 17.5.589 custom | Not specified |
| CNA | Lenovo | Tab Extreme TB570ZU | affected 17.5.589 custom | Not specified |
| CNA | Lenovo | Tab Extreme TB570ZU/TB570FU | affected 17.5.589 custom | Not specified |
| CNA | Lenovo | Tab K11 TB330FUP | affected 17.0.135 custom | Not specified |
| CNA | Lenovo | Tab K11 TB330XUP | affected 17.0.157 custom | Not specified |
| CNA | Lenovo | Tab K11 Plus TB352FU | affected 17.0.10.344 custom | Not specified |
| CNA | Lenovo | Tab K11 Plus TB352XU | affected 17.0.10.336 custom | Not specified |
| CNA | Lenovo | Tab K11 Plus LTE ROW TB352XU | affected 17.0.10.336 custom | Not specified |
| CNA | Lenovo | Tab K11 Plus WIFI ROW TB352FU | affected 17.0.10.344 custom | Not specified |
| CNA | Lenovo | Tab M10 5G TB360ZU | affected 16.0.939 custom | Not specified |
| CNA | Lenovo | Tab K9 TB305FU | affected 17.0.10.324 custom | Not specified |
| CNA | Lenovo | Tab K9 TB305XU | affected 17.0.10.318 custom | Not specified |
| CNA | Lenovo | Tab One TB305FU | affected 17.0.10.324 custom | Not specified |
| CNA | Lenovo | Tab One TB305XU | affected 17.0.10.254 custom | Not specified |
| CNA | Lenovo | Tab P12 TB370FU | affected 17.0.352 custom | Not specified |
| CNA | Lenovo | Tab P12 TB370FU/TB372FU | affected TB370FU：17.0.352, TB372FC：17.0.223 custom | Not specified |
| CNA | Lenovo | Tab P12 TB372FU | affected 17.0.223 custom | Not specified |
| CNA | Lenovo | Tab Plus TB351FU | affected 17.5.10.199 custom | Not specified |
| CNA | Lenovo | Tab With Clear Case/ Lenovo Tab With Folio Case TB311FU | affected 17.5.36.417 custom | Not specified |
| CNA | Lenovo | Tab With Clear Case/ Lenovo Tab With Folio Case TB311FU/TB311XU | affected TB311FU：17.5.36.417 ,TB311XU：17.5.37.350 custom | Not specified |
| CNA | Lenovo | Tab With Clear Case/ Lenovo Tab With Folio Case TB311XU | affected 17.5.37.350 custom | Not specified |
| CNA | Lenovo | Yoga Tab TB710FU | affected 17.5.04.082 custom | Not specified |
| CNA | Lenovo | Yoga Tab Plus TB520FU | affected 17.5.10.362 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.lenovo.com/us/en/product_security/LEN-218699 | [email protected] | support.lenovo.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Lenovo thanks Deepak Toshniwal and Ayansh Toshniwal for reporting this issue. (en)
Additional Advisory Data
Solutions
CNA: Update to the version (or higher) as recommended in the advisory - https://support.lenovo.com/us/en/product_security/LEN-218699
There are currently no legacy QID mappings associated with this CVE.