CVE-2025-14058 - Vulnerability Details

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Lenovo

Tab M11 TB330FU TB330XU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.284

Lenovo

Tab K11 TB330FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.284

Lenovo

Tab K11 TB330FUP

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.254

Lenovo

Tab K11 TB330XU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.084

Lenovo

Tab K11 TB330XUP

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.254

Lenovo

Idea Tab Pro TB373FU

unaffected

Version	Status	Constraints
`0`	affected	< ZUI_17.0.04.266_ST_251120

Lenovo

Tab K9 TB305FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.118

Lenovo

Tab K9 TB305XU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.098

Lenovo

Tab Plus TB351FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.5.10.023

Lenovo

Tab M8 4th Gen 2024 TB301FU

unaffected

Version	Status	Constraints
`0`	affected	< TB301FU_USR_S000126_250919_MP1V1111_ROW

Lenovo

Tab M8 4th Gen 2024 TB301XU

unaffected

Version	Status	Constraints
`0`	affected	< TB301XU_USR_S000147_250919_MP1V1111_ROW

Lenovo

Tab Extreme TB570ZU TB570FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.5.184

Lenovo

Tab M10 5G TB360ZU

unaffected

Version	Status	Constraints
`0`	affected	< 16.0.882

Lenovo

Tab M8 4th Gen TB300FU

unaffected

Version	Status	Constraints
`0`	affected	< TB300XU_USR_S100149_250919_MP1V1111_ROW

Lenovo

Tab M8 4th Gen TB300XU

unaffected

Version	Status	Constraints
`0`	affected	< TB300FU_USR_S100122_250919_MP1V1111_ROW

Lenovo

Tab M9 TB310FU

unaffected

Version	Status	Constraints
`0`	affected	< TB310XU_USR_S000913_2510021921_mp1V969_ROW

Lenovo

Tab M9 TB310XU

unaffected

Version	Status	Constraints
`0`	affected	< TB310FU_USR_S000912_2510022135_mp1V969_ROW

Lenovo

Tab P11 2nd Gen TB350XU

unaffected

Version	Status	Constraints
`0`	affected	< TB350FU_USER_S231044_2601050946

Lenovo

Tab P11 2nd Gen TB350FU

unaffected

Version	Status	Constraints
`0`	affected	< TB350XU_USER_S231018_2601050930

Lenovo

Tab P12 TB370FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.267

Lenovo

Tab P12 TB372FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.267

Lenovo

Tab K11 Plus LTE TB352FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.250

Lenovo

Tab K11 Plus LTE TB352XU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.242

Lenovo

Yoga Tab Plus TB520FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.5.10.036

Lenovo

Tab K11 Gen 2 TB336ZU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.541

Lenovo

TAB7

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.10.541

Lenovo

Lenovo Tab with Clear Case TB311FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.30.303

Lenovo

Lenovo Tab with Folio Case TB311XU

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.31.259

Lenovo

Legion Tab TB321FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.5.10.031

Lenovo

Legion Tab TB320FC

unaffected

Version	Status	Constraints
`0`	affected	< 17.0.339

Lenovo

Idea Tab TB336FU

unaffected

Version	Status	Constraints
`0`	affected	< 17.5.10.041

No data.

Project Subscriptions

Vendors	Products
Lenovo Subscribe	Idea Tab Pro Tb373fu Subscribe Idea Tab Tb336fu Subscribe Legion Tab Tb320fc Subscribe Legion Tab Tb321fu Subscribe Lenovo Tab With Clear Case Tb311fu Subscribe Lenovo Tab With Folio Case Tb311xu Subscribe Tab7 Subscribe Tab Extreme Tb570zu Tb570fu Subscribe Tab K11 Gen 2 Tb336zu Subscribe Tab K11 Plus Lte Tb352fu Subscribe Tab K11 Plus Lte Tb352xu Subscribe Tab K11 Tb330fu Subscribe Tab K11 Tb330fup Subscribe Tab K11 Tb330xu Subscribe Tab K11 Tb330xup Subscribe Tab K9 Tb305fu Subscribe Tab K9 Tb305xu Subscribe Tab M10 5g Tb360zu Subscribe Tab M11 Tb330fu Tb330xu Subscribe Tab M8 4th Gen 2024 Tb301fu Subscribe Tab M8 4th Gen 2024 Tb301xu Subscribe Tab M8 4th Gen Tb300fu Subscribe Tab M8 4th Gen Tb300xu Subscribe Tab M9 Tb310fu Subscribe Tab M9 Tb310xu Subscribe Tab P11 2nd Gen Tb350fu Subscribe Tab P11 2nd Gen Tb350xu Subscribe Tab P12 Tb370fu Subscribe Tab P12 Tb372fu Subscribe Tab Plus Tb351fu Subscribe Yoga Tab Plus Tb520fu Subscribe

Advisories

No advisories yet.

Fixes

Solution

Update to the version (or higher) as recommended in the advisory: https://support.lenovo.com/us/en/product_security/LEN-207951

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support.lenovo.com/us/en/product_security/LEN-207951

History

Thu, 15 Jan 2026 16:15:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:lenovo:tab_p12_tb370fu:tdb:::::::* cpe:2.3:a:lenovo:tab_p12_tb372fu:tdb:::::::*	cpe:2.3:a:lenovo:tab_p12_tb370fu:::::::: cpe:2.3:a:lenovo:tab_p12_tb372fu::::::::

Thu, 15 Jan 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Jan 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.
First Time appeared		Lenovo Lenovo idea Tab Pro Tb373fu Lenovo idea Tab Tb336fu Lenovo legion Tab Tb320fc Lenovo legion Tab Tb321fu Lenovo lenovo Tab With Clear Case Tb311fu Lenovo lenovo Tab With Folio Case Tb311xu Lenovo tab7 Lenovo tab Extreme Tb570zu Tb570fu Lenovo tab K11 Gen 2 Tb336zu Lenovo tab K11 Plus Lte Tb352fu Lenovo tab K11 Plus Lte Tb352xu Lenovo tab K11 Tb330fu Lenovo tab K11 Tb330fup Lenovo tab K11 Tb330xu Lenovo tab K11 Tb330xup Lenovo tab K9 Tb305fu Lenovo tab K9 Tb305xu Lenovo tab M10 5g Tb360zu Lenovo tab M11 Tb330fu Tb330xu Lenovo tab M8 4th Gen 2024 Tb301fu Lenovo tab M8 4th Gen 2024 Tb301xu Lenovo tab M8 4th Gen Tb300fu Lenovo tab M8 4th Gen Tb300xu Lenovo tab M9 Tb310fu Lenovo tab M9 Tb310xu Lenovo tab P11 2nd Gen Tb350fu Lenovo tab P11 2nd Gen Tb350xu Lenovo tab P12 Tb370fu Lenovo tab P12 Tb372fu Lenovo tab Plus Tb351fu Lenovo yoga Tab Plus Tb520fu
Weaknesses		CWE-306
CPEs		cpe:2.3:a:lenovo:idea_tab_pro_tb373fu:::::::: cpe:2.3:a:lenovo:idea_tab_tb336fu:::::::: cpe:2.3:a:lenovo:legion_tab_tb320fc:::::::: cpe:2.3:a:lenovo:legion_tab_tb321fu:::::::: cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_tb311fu:::::::: cpe:2.3:a:lenovo:lenovo_tab_with_folio_case_tb311xu:::::::: cpe:2.3:a:lenovo:tab7:::::::: cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu:::::::: cpe:2.3:a:lenovo:tab_k11_gen_2_tb336zu:::::::: cpe:2.3:a:lenovo:tab_k11_plus_lte_tb352fu:::::::: cpe:2.3:a:lenovo:tab_k11_plus_lte_tb352xu:::::::: cpe:2.3:a:lenovo:tab_k11_tb330fu:::::::: cpe:2.3:a:lenovo:tab_k11_tb330fup:::::::: cpe:2.3:a:lenovo:tab_k11_tb330xu:::::::: cpe:2.3:a:lenovo:tab_k11_tb330xup:::::::: cpe:2.3:a:lenovo:tab_k9_tb305fu:::::::: cpe:2.3:a:lenovo:tab_k9_tb305xu:::::::: cpe:2.3:a:lenovo:tab_m10_5g_tb360zu:::::::: cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu:::::::: cpe:2.3:a:lenovo:tab_m8_4th_gen_2024_tb301fu:::::::: cpe:2.3:a:lenovo:tab_m8_4th_gen_2024_tb301xu:::::::: cpe:2.3:a:lenovo:tab_m8_4th_gen_tb300fu:::::::: cpe:2.3:a:lenovo:tab_m8_4th_gen_tb300xu:::::::: cpe:2.3:a:lenovo:tab_m9_tb310fu:::::::: cpe:2.3:a:lenovo:tab_m9_tb310xu:::::::: cpe:2.3:a:lenovo:tab_p11_2nd_gen_tb350fu:::::::: cpe:2.3:a:lenovo:tab_p11_2nd_gen_tb350xu:::::::: cpe:2.3:a:lenovo:tab_p12_tb370fu:tdb:::::::* cpe:2.3:a:lenovo:tab_p12_tb372fu:tdb:::::::* cpe:2.3:a:lenovo:tab_plus_tb351fu:::::::: cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu::::::::
Vendors & Products		Lenovo Lenovo idea Tab Pro Tb373fu Lenovo idea Tab Tb336fu Lenovo legion Tab Tb320fc Lenovo legion Tab Tb321fu Lenovo lenovo Tab With Clear Case Tb311fu Lenovo lenovo Tab With Folio Case Tb311xu Lenovo tab7 Lenovo tab Extreme Tb570zu Tb570fu Lenovo tab K11 Gen 2 Tb336zu Lenovo tab K11 Plus Lte Tb352fu Lenovo tab K11 Plus Lte Tb352xu Lenovo tab K11 Tb330fu Lenovo tab K11 Tb330fup Lenovo tab K11 Tb330xu Lenovo tab K11 Tb330xup Lenovo tab K9 Tb305fu Lenovo tab K9 Tb305xu Lenovo tab M10 5g Tb360zu Lenovo tab M11 Tb330fu Tb330xu Lenovo tab M8 4th Gen 2024 Tb301fu Lenovo tab M8 4th Gen 2024 Tb301xu Lenovo tab M8 4th Gen Tb300fu Lenovo tab M8 4th Gen Tb300xu Lenovo tab M9 Tb310fu Lenovo tab M9 Tb310xu Lenovo tab P11 2nd Gen Tb350fu Lenovo tab P11 2nd Gen Tb350xu Lenovo tab P12 Tb370fu Lenovo tab P12 Tb372fu Lenovo tab Plus Tb351fu Lenovo yoga Tab Plus Tb520fu
References		https://support.lenovo.com/us/en/product_security/LEN-207951
Metrics		cvssV3_1 `{'score': 3.2, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}` cvssV4_0 `{'score': 2.4, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2026-01-14T22:20:37.631Z

Updated: 2026-01-15T15:56:05.902Z

Reserved: 2025-12-04T19:05:38.655Z

Link: CVE-2025-14058

Vulnrichment

Updated: 2026-01-15T14:48:42.571Z

NVD

Status : Awaiting Analysis

Published: 2026-01-14T23:15:55.970

Modified: 2026-01-16T15:55:33.063

Link: CVE-2025-14058

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-306

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object