Tab Extreme Tb570Zu
Monthly
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.