CVE-2025-10495CWE-295

CVE-2025-10495

High · published November 13, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

⚡ An attacker on the same network could run arbitrary code on your Lenovo device, and that’s a scary thought! 🚨 Think of it like a sneaky waiter who can access the kitchen and switch your order with something completely different without anyone noticing — the potential for chaos is massive! If exploited, this vulnerability could allow an attacker to take control of your system, potentially leading to data theft, unauthorized actions, or even a complete takeover of your device. It’s like giving a stranger the keys to your house while you’re away — absolutely devastating!

Put simply

Think of it like a sneaky waiter who can access the kitchen and switch your order with something completely different without anyone noticing — the potential for chaos is massive! The vulnerability lies within the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications. Under certain conditions, it allows an attacker on the same logical network to execute arbitrary code, leading to severe security implications.

What to do

If exploited, this vulnerability could allow an attacker to take control of your system, potentially leading to data theft, unauthorized actions, or even a complete takeover of your device. It’s like giving a stranger the keys to your house while you’re away — absolutely devastating! To safeguard against this threat, update your Lenovo applications to the latest versions immediately. Monitor your network and consider implementing additional security measures, like segmentation, to isolate devices. Don’t wait—secure your tech! You’ve got this! Follow these steps and you’ll keep your devices locked down tight. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-11-13T01:15Z
References (1)
EPSS history
Timeline
  • 12 NOV 19:18Z
    A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under…
    cvelistv5