JVN#33436631
Multiple Lenovo Tablets shipped with a known private test key for Android Verified Boot

Overview

Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot.

Products Affected

Multiple products are affected by this vulnerability. For details, see the "Vendor Status" section.

Description

Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot.

• Use of Weak Credentials (CWE-1391)
  • CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 7.0
  • CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 6.6
  • CVE-2026-92777

Impact

With physical access to the affected device, a crafted system image may be installed.

Solution

Update the Firmware
Update the firmware to the latest version according to the information provided by the developer.

Stop using the products
Since no fixes are provided for products whose support has already ended, stop using the vulnerable products and consider switching to alternatives.