CVE-2025-14058

Severity: low (CVSS 3.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-14 · updated 2026-06-17
Weakness: CWE-306

Description

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.

Affected products

Lenovo Idea Tab Pro (TB373FU): before ZUI_17.0.04.266_ST_251120 — fixed in ZUI_17.0.04.266_ST_251120
Lenovo Idea Tab TB336FU: before 17.5.10.041 — fixed in 17.5.10.041
Lenovo Legion Tab TB320FC: before 17.0.339 — fixed in 17.0.339
Lenovo Legion Tab TB321FU: before 17.5.10.031 — fixed in 17.5.10.031
Lenovo Tab with Clear Case TB311FU: before 17.0.30.303 — fixed in 17.0.30.303
Lenovo Tab with Folio Case TB311XU: before 17.0.31.259 — fixed in 17.0.31.259
Lenovo TAB7: before 17.0.10.541 — fixed in 17.0.10.541
Lenovo Tab Extreme TB570ZU TB570FU: before 17.5.184 — fixed in 17.5.184
Lenovo Tab K11 Gen 2 TB336ZU: before 17.0.10.541 — fixed in 17.0.10.541
Lenovo Tab K11 Plus LTE TB352FU: before 17.0.10.250 — fixed in 17.0.10.250
Lenovo Tab K11 Plus LTE TB352XU: before 17.0.10.242 — fixed in 17.0.10.242
Lenovo Tab K11 TB330FU: before 17.0.284 — fixed in 17.0.284
Lenovo Tab K11 (TB330FUP): before 17.0.254 — fixed in 17.0.254
Lenovo Tab K11 TB330XU: before 17.0.084 — fixed in 17.0.084
Lenovo Tab K11 (TB330XUP): before 17.0.254 — fixed in 17.0.254
Lenovo Tab K9 (TB305FU): before 17.0.10.118 — fixed in 17.0.10.118
Lenovo Tab K9 (TB305XU): before 17.0.10.098 — fixed in 17.0.10.098
Lenovo Tab M10 5G (TB360ZU): before 16.0.882 — fixed in 16.0.882
Lenovo Tab M11 TB330FU TB330XU: before 17.0.284 — fixed in 17.0.284
Lenovo Tab M8 4th Gen 2024 TB301FU: before TB301FU_USR_S000126_250919_MP1V1111_ROW — fixed in TB301FU_USR_S000126_250919_MP1V1111_ROW
Lenovo Tab M8 4th Gen 2024 TB301XU: before TB301XU_USR_S000147_250919_MP1V1111_ROW — fixed in TB301XU_USR_S000147_250919_MP1V1111_ROW
Lenovo Tab M8 4th Gen TB300FU: before TB300XU_USR_S100149_250919_MP1V1111_ROW — fixed in TB300XU_USR_S100149_250919_MP1V1111_ROW
Lenovo Tab M8 4th Gen TB300XU: before TB300FU_USR_S100122_250919_MP1V1111_ROW — fixed in TB300FU_USR_S100122_250919_MP1V1111_ROW
Lenovo Tab M9 TB310FU: before TB310XU_USR_S000913_2510021921_mp1V969_ROW — fixed in TB310XU_USR_S000913_2510021921_mp1V969_ROW
Lenovo Tab M9 TB310XU: before TB310FU_USR_S000912_2510022135_mp1V969_ROW — fixed in TB310FU_USR_S000912_2510022135_mp1V969_ROW
Lenovo Tab P11 2nd Gen TB350FU: before TB350XU_USER_S231018_2601050930 — fixed in TB350XU_USER_S231018_2601050930
Lenovo Tab P11 2nd Gen TB350XU: before TB350FU_USER_S231044_2601050946 — fixed in TB350FU_USER_S231044_2601050946
Lenovo Tab P12 (TB370FU): before 17.0.267 — fixed in 17.0.267
Lenovo Tab P12 (TB372FU): before 17.0.267 — fixed in 17.0.267
Lenovo Tab Plus (TB351FU): before 17.5.10.023 — fixed in 17.5.10.023

How to fix

Upgrade to a fixed version: Lenovo Idea Tab Pro (TB373FU) ZUI_17.0.04.266_ST_251120; Lenovo Idea Tab TB336FU 17.5.10.041; Lenovo Legion Tab TB320FC 17.0.339; Lenovo Legion Tab TB321FU 17.5.10.031; Lenovo Tab with Clear Case TB311FU 17.0.30.303; Lenovo Tab with Folio Case TB311XU 17.0.31.259; Lenovo TAB7 17.0.10.541; Lenovo Tab Extreme TB570ZU TB570FU 17.5.184; Lenovo Tab K11 Gen 2 TB336ZU 17.0.10.541; Lenovo Tab K11 Plus LTE TB352FU 17.0.10.250; Lenovo Tab K11 Plus LTE TB352XU 17.0.10.242; Lenovo Tab K11 TB330FU 17.0.284. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-207951

Get alerted when CVE-2025-14058 or the next vulnerability affects your stack