CVE-2025-10495

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-12 · updated 2026-10-18
Weakness: CWE-295

Description

A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.

Affected products

Lenovo App Store: before 9.0.2530.1027 — fixed in 9.0.2530.1027
Lenovo Browser: before 9.0.6.9111 — fixed in 9.0.6.9111
Lenovo Legion Zone: before 2.0.21 — fixed in 2.0.21
Lenovo PC Manager: before 5.1.140.9262 — fixed in 5.1.140.9262

How to fix

Upgrade to a fixed version: Lenovo App Store 9.0.2530.1027; Lenovo Browser 9.0.6.9111; Lenovo Legion Zone 2.0.21; Lenovo PC Manager 5.1.140.9262. Check the vendor advisory for mitigations.

References

https://iknow.lenovo.com.cn/detail/434328

Get alerted when CVE-2025-10495 or the next vulnerability affects your stack