Lenovo vulnerabilities
Published CVEs affecting Lenovo products: 78 record(s), with severity, exploitation and fixes.
Vantage 7App Store 6Pcmanager 4Smart Connect 4IdeaPad Slim 3 16IRH8 BIOS 4Legion Pro 7 16ADR10H BIOS 4Software Fix 4Legion 7 16IAX10 BIOS 4ThinkBook 16p G6 IAX BIOS 4Legion 5 15IRX10 BIOS 4Lenovo V15 G6 ARP BIOS 4Legion Pro 5 16IRX10 BIOS 4IdeaPad Slim 3 15AMN8 BIOS 4Yoga Book 9 13IMU9 BIOS 4IdeaPad Slim 3 14ITN9 BIOS 4Yoga 9 2-in-1 14IMH9 BIOS 4IdeaPad Pro 5 16IPH11 BIOS 4LOQ 15ARP10E BIOS 4Idea Tab Pro TB373FU 4Legion Pro 7 16ARX8H BIOS 4Tab K9 TB305FU 4Tab K9 TB305XU 4Lenovo V14 G6 ITN BIOS 4Tab Extreme TB570ZU TB570FU 4Tab M10 5G TB360ZU 4ThinkBook 16p G6 ADR BIOS 4Legion Slim 5 14APH8 BIOS 4Lenovo V15 G2 IJL Laptop BIOS 4IdeaPad Pro 5 16IAH10 BIOS 4Legion Pro 5 16IAX10 BIOS 4Yoga Tab Plus TB520FU 4LOQ 15IAX9E BIOS 4Dock Manager 4IdeaPad Pro 5 16ASP10 BIOS 4Legion Pro 7 16AFR10H BIOS 4Legion Pro 5 16AFR10 BIOS 4Legion 7 16AGP11 BIOS 4IdeaPad Pro 5 16AGP11 BIOS 4Legion 5 15IAX10 BIOS 4Yoga Book 9 14IAH10 BIOS 4
CVE-2025-9214
Medium · 5.4
CWE-306 Sep 11, 2025
A missing authentication vulnerability was reported in some Lenovo printers that could allow a...
A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settings via the CUPS service.
CVE-2025-8061
High · 7.0
CWE-782 Sep 11, 2025
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0...
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected. This vulnerability does not affect systems when the Windows feature Core Isolation Memory Integrity is enabled. Lenovo systems preloaded with Windows 11 have this feature enabled by default.
CVE-2017-5638
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-755 Mar 10, 2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.