Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2025-14058

Missing authentication in Lenovo Tab M11 TB330FU TB330XU and others

CVSS 2.4 LowEPSS 0.0016 · 4th percentile

Published by the CVE Program (CNA: lenovo) at 14 Jan 2026, 22:20 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Lenovo Tab M11 TB330FU TB330XU
  • affected before 17.0.284 custom
Other versions: unaffected
Lenovo Tab K11 TB330FU
  • affected before 17.0.284 custom
Other versions: unaffected
Lenovo Tab K11 TB330FUP
  • affected before 17.0.254 custom
Other versions: unaffected
Lenovo Tab K11 TB330XU
  • affected before 17.0.084 custom
Other versions: unaffected
Lenovo Tab K11 TB330XUP
  • affected before 17.0.254 custom
Other versions: unaffected
Lenovo Idea Tab Pro TB373FU
  • affected before ZUI_17.0.04.266_ST_251120 custom
Other versions: unaffected
Lenovo Tab K9 TB305FU
  • affected before 17.0.10.118 custom
Other versions: unaffected
Lenovo Tab K9 TB305XU
  • affected before 17.0.10.098 custom
Other versions: unaffected
Lenovo Tab Plus TB351FU
  • affected before 17.5.10.023 custom
Other versions: unaffected
Lenovo Tab M8 4th Gen 2024 TB301FU
  • affected before TB301FU_USR_S000126_250919_MP1V1111_ROW custom
Other versions: unaffected
Lenovo Tab M8 4th Gen 2024 TB301XU
  • affected before TB301XU_USR_S000147_250919_MP1V1111_ROW custom
Other versions: unaffected
Lenovo Tab Extreme TB570ZU TB570FU
  • affected before 17.5.184 custom
Other versions: unaffected
Lenovo Tab M10 5G TB360ZU
  • affected before 16.0.882 custom
Other versions: unaffected
Lenovo Tab M8 4th Gen TB300FU
  • affected before TB300XU_USR_S100149_250919_MP1V1111_ROW custom
Other versions: unaffected
Lenovo Tab M8 4th Gen TB300XU
  • affected before TB300FU_USR_S100122_250919_MP1V1111_ROW custom
Other versions: unaffected
Lenovo Tab M9 TB310FU
  • affected before TB310XU_USR_S000913_2510021921_mp1V969_ROW custom
Other versions: unaffected
Lenovo Tab M9 TB310XU
  • affected before TB310FU_USR_S000912_2510022135_mp1V969_ROW custom
Other versions: unaffected
Lenovo Tab P11 2nd Gen TB350XU
  • affected before TB350FU_USER_S231044_2601050946 custom
Other versions: unaffected
Lenovo Tab P11 2nd Gen TB350FU
  • affected before TB350XU_USER_S231018_2601050930 custom
Other versions: unaffected
Lenovo Tab P12 TB370FU
  • affected before 17.0.267 custom
Other versions: unaffected
Lenovo Tab P12 TB372FU
  • affected before 17.0.267 custom
Other versions: unaffected
Lenovo Tab K11 Plus LTE TB352FU
  • affected before 17.0.10.250 custom
Other versions: unaffected
Lenovo Tab K11 Plus LTE TB352XU
  • affected before 17.0.10.242 custom
Other versions: unaffected
Lenovo Yoga Tab Plus TB520FU
  • affected before 17.5.10.036 custom
Other versions: unaffected
Lenovo Tab K11 Gen 2 TB336ZU
  • affected before 17.0.10.541 custom
Other versions: unaffected
Lenovo TAB7
  • affected before 17.0.10.541 custom
Other versions: unaffected
Lenovo Lenovo Tab with Clear Case TB311FU
  • affected before 17.0.30.303 custom
Other versions: unaffected
Lenovo Lenovo Tab with Folio Case TB311XU
  • affected before 17.0.31.259 custom
Other versions: unaffected
Lenovo Legion Tab TB321FU
  • affected before 17.5.10.031 custom
Other versions: unaffected
Lenovo Legion Tab TB320FC
  • affected before 17.0.339 custom
Other versions: unaffected
Lenovo Idea Tab TB336FU
  • affected before 17.5.10.041 custom
Other versions: unaffected
Identifiers
CVE-2025-14058
CNA
lenovo
Weakness (CWE)
CWE-306
Tags
Published
14 Jan 2026
Updated
15 Jan 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
2.4 Low 4.0 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CNA (lenovo)Used for this record
3.2 Low 3.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CNA (lenovo)
  • CISA KEV Not listed.
  • EPSS 0.0016, the 4th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 14 Jan 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.