Lenovo Tablets EUVD-2026-102535

Exploitation requires the attacker to have direct physical possession of an affected Lenovo tablet (e.g., Idea Tab Pro TB373FU, Tab K11 Gen 2, Tab M11, Legion Tab, Tab Extreme, Tab P12, and other listed models); the flaw lets such a user bypass device authentication to gain unauthorized access. The decisive limiting factor is the Physical attack vector (AV:P) - there is no remote, network, or adjacent-network exposure, so the device must be lost, stolen, or left unattended to be at risk. The vendor description cites no additional feature toggle or non-default configuration requirement, and the CVSS vector indicates no privileges (PR:N) and no user interaction (UI:N) beyond that physical access. The exact triggering feature or alternate authentication path is not disclosed in the provided data.

This is a physical-access authentication bypass (CWE-288) in Lenovo consumer tablets. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N) and 7.0 base score are driven almost entirely by the high triad of vulnerable-system impacts (VC:H/VI:H/VA:H) - i.e., full compromise of the device once reached - but gated by the single most risk-reducing signal available: Attack Vector is Physical (AV:P). An attacker must be in physical possession of the target tablet; there is no remote or network exposure. No EPSS score, CISA KEV listing, POC, or SSVC decision data were provided in the input, so exploitation probability and automatability cannot be assessed from the data at hand. The combination of high nominal impact with a mandatory physical-access precondition means this is a meaningful risk for lost/stolen or unattended devices and for threat models involving evil-maid or supply-chain handling, but NOT a mass-exploitation or remote-priority issue. Treat it as medium real-world priority: patch via normal device-update cycles rather than emergency out-of-band response. Note the vendor-supplied vector is CVSS 4.0 only; no CVSS 3.1 vector or EPSS/KEV telemetry was provided to cross-reference against.

An attacker who gains physical possession of an unattended, lost, or stolen Lenovo tablet exploits the authentication-bypass flaw to circumvent the lock screen or device authentication and obtain unauthorized access to the device and its data. No public exploit code was identified in the provided data, and exploitation requires hands-on access to the specific hardware.