Lenovo Android tablets: Arbitrary file write via exported app components

Summary

Several Lenovo Android tablet models contain a vulnerability in which application components are improperly exported (CWE-926). A third-party application installed on the device can write arbitrary files with elevated privileges. The attacker needs a malicious app on the device and user interaction, and cannot reach the tablet over the network. Impact is high on integrity and availability, with no confidentiality impact according to the CVSS 4.0 score of 6.9.

Affected

• Lenovo Idea Tab Pro TB373FU: before 17.5.10.107
• Lenovo Tab One TB305FU and Tab K9 TB305FU: before 17.0.10.324
• Lenovo Tab One TB305XU and Tab K9 TB305XU: before 17.0.10.318
• Lenovo Yoga Tab Plus TB520FU: before 18.5.10.037
• Lenovo Legion Tab 8.8 TB321FU: before 17.5.10.319
• Lenovo Tab with Clear Case / Folio Case TB311FU: before 17.5.36.508
• Lenovo Tab with Clear Case / Folio Case TB311XU: before 17.5.37.529
• Lenovo Idea Tab / Tab K11 Gen 2 TB336FU: before 17.5.10.348
• Lenovo Idea Tab / Tab K11 Gen 2 TB336ZU: before 17.5.10.443
• Lenovo Yoga Tab TB710FU: before 1.5.04.519
• Lenovo Tab Plus TB351FU: threshold listed as TBD
• One further entry (before 17.5.36.508) with unidentified model: Unknown

Fixed in

• Fixed versions as listed in the CVE record (version or higher): TB373FU 17.5.10.107; TB305FU/K9 TB305FU 17.0.10.324; TB305XU/K9 TB305XU 17.0.10.318; TB520FU 18.5.10.037; TB321FU 17.5.10.319; TB311FU 17.5.36.508; TB311XU 17.5.37.529; TB336FU 17.5.10.348; TB336ZU 17.5.10.443; TB710FU 1.5.04.519
• Tab Plus TB351FU: no fixed version known
• Tab K9 and other models without version data in the sources: Unknown
• Versions not yet verified against the Lenovo advisory LEN-220237

Workaround

Unknown.

• For TB351FU and models without a known fix: restrict or remove third-party apps and disable installation of untrusted apps

Exploitation

• OffSeq lists the CVE as not known to be exploited as of 11 Nov 2026.
• No public proof of concept was found.
• A CISA KEV listing was not conclusively checked.
• VulDB's 'easy' rating describes exploitation difficulty, not evidence of active exploitation.

Our recommendation

• Inventory all Lenovo tablets and record exact model and firmware build.
• Install the fixed firmware where a fixed version is listed.
• For TB351FU and unmapped models, treat as open: restrict app installation and remove unneeded third-party apps until Lenovo publishes a fix.
• Prioritise shared or BYOD tablets with open app installation.
• Check LEN-220237 regularly for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Lenovo PSIRT advisory LEN-220237 support.lenovo.com
• CVE Record CVE-2026-116633 www.cve.org
• VulDB entry 435857 vuldb.com
• OffSeq Radar CVE-2026-116633 radar.offseq.com
• threatint CVE-2026-116633 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:26.