CVE-2025-11193

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256

Affected software

VendorProductVersions
LenovoTab M11 TB330FU TB330XU< TB330FU_ROW_OPEN_USER_V5_V_ZUI_17.0.274_ST_251011; < TB330XU_ROW_OPEN_USER_V5_V_ZUI_17.0.235_ST_251011
LenovoTab K11 TB330FU TB330FUP TB330XU TB330XUP< TB330FU_ROW_OPEN_USER_V5_V_ZUI_17.0.274_ST_251011; < TB330XU_ROW_OPEN_USER_V5_V_ZUI_17.0.235_ST_251011
LenovoIdea Tab Pro TB373FU< 17.0.04.184
LenovoTab WiFi 5G< 17.0.10.457
LenovoTab K9 TB305FU< 17.0.10.069
LenovoTab K9 TB305XU< 17.0.10.065
LenovoTab Plus TB520FU< 17.0.12.203
LenovoTab M8 4th Gen 2024 TB301FU TB301XU< TB300FU_USR_S101112_250919_MP1V1111_ROW; < TB300XU_USR_S101103_250919_MP1V1111_ROW
LenovoTab Extreme TB570ZU TB570FU< 17.0.104
LenovoTab M10 5G TB360ZU< 16.0.783
LenovoTab M8 4th Gen TB300FU TB300XU< TB300FU_USR_S101112_250919_MP1V1111_ROW; < TB300XU_USR_S101103_250919_MP1V1111_ROW
LenovoTab M9 TB310FU TB310XU< TB310FU_USR_S000912_2510022135_mp1V969_ROW; < TB310XU_USR_S000913_2510021921_mp1V969_ROW
LenovoTab P11 2nd Gen TB350XU TB350FU< TB350XU_USER_S230920_2508120308_MP_ROW; < TB350FU_USER_S230917_2508090248_MP_ROW
LenovoTab P12 TB370FU TB372FU< TB370FU_ROW_OPEN_USER_V5_V_ZUI_17.0.187_ST_250817; < TB372FC_ROW_OPEN_USER_V5_V_ZUI_17.0.116_ST_250822
LenovoTab WIFI< 17.0.30.303
LenovoTab K11 Plus LTE TB352FU TB352XU< 17.0.10.213
LenovoTab K11 Plus WIFI TB352FU< 17.0.10.213
LenovoYoga Tab Plus TB520FU< 17.5.10.035
LenovoTab One TB305FUXU< 17.0.10.107

References

Timeline

Published
Nov 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-111953.3Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project CVE-2025-111964.3The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to CVE-2025-111976.4The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, CVE-2025-111987.4A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticatedCVE-2025-112009.8MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication oCVE-2025-112019.8MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers toCVE-2025-112029.8win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to eCVE-2025-112033.5LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inCVE-2025-112047.2The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL InjeCVE-2025-112058.8Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process toCVE-2025-112067.1Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via CVE-2025-112076.5Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/writ
CVE-2025-11193: Medium severity, CVSS 5.5 | Vulnix