EUVD-2026-75749
GHSA-w7vv-xhmp-9qcq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Lenovo Health APK
-
ExploitDecompile and extract hardcoded credential
-
ExecutionAuthenticate to health-data backend
-
ImpactRetrieve victims' sensitive health information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of the Lenovo Health Android app package (obtainable from the Chinese app distribution channel) and the ability to reach its cloud backend over the network; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are needed once the hardcoded credential is extracted. The principal limiting factor is market scope - the app is distributed only in China, so the exposed user base and backend are region-specific - and successful data access depends on the embedded credential still being valid on Lenovo's servers. Whether integrity (data modification) is actually achievable is unconfirmed; the description supports only read access to health data. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) implies a fully remote, unauthenticated, low-complexity attack, which is plausible for hardcoded credentials that unlock a network-reachable backend. However, the vector's VI:H (high integrity impact) is not supported by the description, which describes only reading sensitive health information - the confidentiality claim is well-grounded while the integrity claim appears overstated and should be verified with Lenovo. Real-world risk is tempered by scope: the app is distributed exclusively in the Chinese market, so the exposed population is regional rather than global. There is no KEV listing and no known POC, and no EPSS score was provided, so exploitation appears theoretical for now rather than active; that said, hardcoded-credential flaws are easy to weaponize once the app is reverse-engineered, so operators of the affected app should treat the confidentiality exposure as a priority to patch promptly. |
| Exploit ScenarioDerived | An attacker downloads the Lenovo Health APK, decompiles it, and extracts the hardcoded backend credential or API key. Using that secret from any internet-connected host, they authenticate to Lenovo's health-data service and retrieve other users' sensitive health information without owning those accounts. No public POC is known at time of analysis, but the extraction technique is standard mobile reverse-engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Update the Lenovo Health app to the fixed release referenced in Lenovo's advisory (https://iknow.lenovo.com.cn/detail/442248); no exact patched version number was provided in the input, so confirm the fixed build directly with Lenovo. Because the flaw is server-side-reachable via hardcoded credentials, the durable fix must include Lenovo rotating/revoking the embedded secrets and moving to per-user authentication tokens - a client update alone is insufficient if the leaked credential remains valid, so users should not assume safety until Lenovo confirms backend credential rotation. As a user-side interim measure, minimize the health data stored in the app and monitor accounts for anomalous access; there is no meaningful client-side configuration workaround since the credential is baked into the binary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a native Android mobile application (Lenovo Health) that presumably communicates with a Lenovo cloud backend to store and retrieve personal health metrics. The root cause is CWE-798 (Use of Hard-coded Credentials): secrets such as API keys, service-account passwords, or backend access tokens are embedded directly in the shipped app binary. Because Android APKs are trivially decompiled, any hardcoded secret is effectively public, and if that secret grants access to a health-data API, an attacker can reuse it to reach data that should be gated behind per-user authentication. No CPE strings were supplied, so exact package name and version boundaries are not enumerated in the input.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Hardcoded credential extractable from the APK enables remote unauthenticated access to health data (C:H); description supports confidentiality only, so I:N/A:N despite the vendor vector's VI:H.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
DescriptionCVE.org
A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.
Articles & Coverage 1
Executive ViewAI
Lenovo Health Android application (China market) contains hardcoded credentials enabling unauthorized access to users' health data; no public exploit identified at time of analysis. Organizations with Chinese user bases or unrestricted BYOD policies face direct risk of health data breach and associated regulatory exposure under privacy protection frameworks.
No vendor-released patch identified at time of analysis. Interim mitigations: immediate uninstallation of affected Lenovo Health app, mobile device management policies to block installation, discontinuation of personal health data input in application, and monitoring logs for unauthorized account access if user credentials compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB