Live › vulnerability › CVE-2026-89057
Go to dashboardSome Lenovo tablets have a potential authentication bypass. A user with physical access to the device could gain unauthorized access to it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that issue or manage Lenovo Android tablets (Idea Tab, Tab K11/K11 Plus/K9/M11/P12/Extreme/One, Legion Tab, Yoga Tab and others) on firmware below the fixed builds. The attacker needs the device in hand, so lost, stolen or shared tablets, kiosks and field devices matter most. Teams with no Lenovo tablets, or none that leave controlled premises, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Idea Tab Pro TB373FU | vendor | < 17.5.10.107 | 17.5.10.107 |
| Tab K11 Gen 2 TB336FU | vendor | < 17.5.10.348 | 17.5.10.348 |
| Tab K11 Gen 2 TB336ZU | vendor | < 17.5.10.354 | 17.5.10.354 |
| Tab M11 TB330FU | vendor | < 17.0.135 | 17.0.135 |
| Legion Tab TB321FU | vendor | < 17.5.10.319 | 17.5.10.319 |
| Tab P12 TB370FU | vendor | < 17.0.352 | 17.0.352 |
| Yoga Tab Plus TB520FU | vendor | < 17.5.10.362 | 17.5.10.362 |
17.5.10.107, Tab K11 Gen 2 TB336FU 17.5.10.348 / TB336ZU 17.5.10.354, Tab M11 TB330FU 17.0.135, Legion Tab TB321FU 17.5.10.319, Tab P12 TB370FU 17.0.352, Yoga Tab Plus TB520FU 17.5.10.362Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
This page as .md · .json · in your agent: get_signal("CVE-2026-89057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.