{"id":"CVE-2026-89057","kind":"vulnerability","aliases":["CVE-2026-89057"],"related":[],"title":"Lenovo tablets: authentication bypass lets local user gain device access","description":"A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.","summary":"Some Lenovo tablets have a potential authentication bypass. A user with physical access to the device could gain unauthorized access to it.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Idea Tab Pro TB373FU","fixed":["17.5.10.107"],"affected":"< 17.5.10.107","ecosystem":"vendor"},{"name":"Tab K11 Gen 2 TB336FU","fixed":["17.5.10.348"],"affected":"< 17.5.10.348","ecosystem":"vendor"},{"name":"Tab K11 Gen 2 TB336ZU","fixed":["17.5.10.354"],"affected":"< 17.5.10.354","ecosystem":"vendor"},{"name":"Tab M11 TB330FU","fixed":["17.0.135"],"affected":"< 17.0.135","ecosystem":"vendor"},{"name":"Legion Tab TB321FU","fixed":["17.5.10.319"],"affected":"< 17.5.10.319","ecosystem":"vendor"},{"name":"Tab P12 TB370FU","fixed":["17.0.352"],"affected":"< 17.0.352","ecosystem":"vendor"},{"name":"Yoga Tab Plus TB520FU","fixed":["17.5.10.362"],"affected":"< 17.5.10.362","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","endpoint","firmware","infrastructure","lenovo","physical-access","tablets"],"not_affected_if":["devices-not-physically-accessible","firmware-updated","no-lenovo-tablets"],"how_to_check":"On the tablet: Settings > About tablet > Build number / software version, and compare with the fixed build for your model (model number is on the same screen). Anything below the fixed build is affected.","fix":"Update tablet firmware to at least the fixed build for your model (Lenovo advisory LEN-218699), e.g. Idea Tab Pro TB373FU 17.5.10.107, Tab K11 Gen 2 TB336FU 17.5.10.348 / TB336ZU 17.5.10.354, Tab M11 TB330FU 17.0.135, Legion Tab TB321FU 17.5.10.319, Tab P12 TB370FU 17.0.352, Yoga Tab Plus TB520FU 17.5.10.362. Other models are in the product list.","status":"open","published_at":"2026-10-16T00:17:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:38:30+00:00","updated_at":"2026-10-25T03:50:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:38:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo tablets: authentication bypass lets local user gain device access","impact":"high","summary":"Some Lenovo tablets have a potential authentication bypass. A user with physical access to the device could gain unauthorized access to it.","category":"infrastructure","nicknames":[],"who_cares":["lenovo","tablets","endpoint"],"confidence":0.4,"needs_auth":"no","worst_case":"Physical attacker gains unauthorized access to the tablet","analyst_note":"Find the Lenovo security bulletin for CVE-2026-89057 listing affected tablet models, firmware versions and fixed builds.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-lenovo-tablets"],"who_is_affected":"Teams that issue or manage Lenovo tablets with physical access exposure. The sources do not list affected models or firmware versions. Organizations without Lenovo tablets can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000515,"input_tokens":3262,"output_tokens":378,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Lenovo security bulletin for CVE-2026-89057 listing affected tablet models, firmware versions and fixed builds.","search":"'-2026':12A,15A '-89057':13A,16A '2':24A,29A 'access':10A,51B,65B,72B,91C,96C 'allow':86C 'android':44B 'authent':3A,59B,75C 'bypass':4A,60B,76C 'could':69B,85C 'cve':11A,14A 'devic':9A,68B,95C 'endpoint':45B 'firmwar':46B 'gain':8A,70B,93C 'gen':23A,28A 'idea':17A 'infrastructur':47B 'k11':22A,27A 'legion':34A 'lenovo':1A,48B,54B,82C 'let':5A 'local':6A 'm11':32A 'p12':38A 'physic':50B,64B,90C 'physical-access':49B 'plus':42A 'potenti':58B,74C 'pro':19A 'report':79C 'tab':18A,21A,26A,31A,35A,37A,41A 'tablet':2A,52B,55B,83C 'tb321fu':36A 'tb330fu':33A 'tb336fu':25A 'tb336zu':30A 'tb370fu':39A 'tb373fu':20A 'tb520fu':43A 'unauthor':71B,94C 'user':7A,62B,88C 'vulner':77C 'yoga':40A","nicknames":[],"mitigations":[],"who_affected":"Teams that issue or manage Lenovo Android tablets (Idea Tab, Tab K11/K11 Plus/K9/M11/P12/Extreme/One, Legion Tab, Yoga Tab and others) on firmware below the fixed builds. The attacker needs the device in hand, so lost, stolen or shared tablets, kiosks and field devices matter most. Teams with no Lenovo tablets, or none that leave controlled premises, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89057","severity":null,"published_at":"2026-10-16T00:17:06+00:00","modified_at":"2026-10-16T19:55:59+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89057:802","url":null,"severity":null,"published_at":"2026-10-25T03:50:13+00:00","modified_at":"2026-10-25T03:50:13+00:00","first_seen_at":"2026-10-25T03:50:13+00:00","fetched_at":"2026-10-25T03:50:13+00:00","note":"Lenovo advisory LEN-218699 unreadable (JS/403). Affected models and fixed firmware taken from the Lenovo CNA record as mirrored by EUVD-2026-102535; not verified against the vendor page. Physical access only, no exploitation or PoC found."}],"documents":[{"id":3368,"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102535","title":"EUVD-2026-102535 (CNA data from Lenovo: affected models and fixed firmware)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3369,"url":"https://support.lenovo.com/us/en/product_security/LEN-218699","title":"Lenovo LEN-218699 Tablet Authentication Bypass (not readable: JS/403)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}