Local Authentication Bypass in ThinkPlus Configuration Software by Lenovo
CVE-2025-13454

6.8MEDIUM

Key Information:

Vendor

Lenovo
Status
Thinkplus Fu100
Thinkplus Fu200
Thinkplus Tu800
Thinkplus Tsd303
Vendor
CVE Published:
14 January 2026

What is CVE-2025-13454?

A vulnerability has been identified in Lenovo's ThinkPlus configuration software that allows a local authenticated user to potentially access sensitive device information. This issue stems from inadequate protection mechanisms that could be exploited by users with legitimate access. Organizations using ThinkPlus are advised to review their security protocols and apply necessary measures to safeguard against unauthorized data access.

Affected Version(s)

ThinkPlus FU100 Gen 1

ThinkPlus FU200 Gen 1

ThinkPlus TSD303 Gen 1

References

https://iknow.lenovo.com.cn/detail/436983

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Xusheng Li (Vector 35 Inc) for reporting these issues.
.