Lenovo LeCloud CVE-2025-10699

Exploitation requires improper TLS certificate validation in the LeCloud client (CWE-295) to be triggerable, which per the CVSS 4.0 vector needs an attacker to satisfy a specific attack requirement (AT:P) - in practice, holding a man-in-the-middle position on the network between the client and Lenovo's cloud service - and requires passive user interaction (UI:P), namely the victim running the client so it initiates the vulnerable connection. The description qualifies the flaw as occurring only 'under certain conditions,' which are not enumerated in the supplied data. Limiting factors that reduce realistic risk: the attacker must already intercept the victim's traffic, the victim must actively use the affected client, impact is confined to confidentiality (no integrity or availability loss), and no authentication is required by the attacker (PR:N) but no remote-on-demand reachability exists either.

This is a MEDIUM-severity (CVSS 4.0 base 6.0) issue that should be treated as a low-to-moderate priority rather than an emergency. The strongest real-world signals all point downward: EPSS is 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC:H only) shows a network-reachable but condition-dependent attack: the AT:P (attack requirements present) and UI:P (passive user interaction) metrics mean the attacker cannot simply reach the target on demand - exploitation depends on a specific set of circumstances plus the victim using the client. Combined with CWE-295 (Improper Certificate Validation), the realistic model is a man-in-the-middle attacker who intercepts the LeCloud client's TLS traffic to disclose confidential data (VC:H), with no integrity or availability impact. No SSVC decision data, POC, or KEV evidence was provided, so there is no signal of automatable or active exploitation. Note the data gap: the description is deliberately vague ('under certain conditions could allow information disclosure') and does not name the exact flaw, so the CWE-295 classification and the MITM interpretation are inferred from the CWE and vector, not confirmed by the Lenovo advisory text supplied.

An attacker positioned on the network path (e.g., shared Wi-Fi, compromised router, or rogue access point) intercepts the TLS connection the Lenovo LeCloud client makes to its cloud backend. Because the client improperly validates the server certificate (CWE-295), the attacker presents a forged certificate, the client accepts it, and sensitive user data in transit is disclosed. No public exploit code is referenced, and success depends on the victim actively using the client while the attacker holds the interception position.