Authentication bypass and untrusted fingerprint enrollment in Lenovo ThinkPlus

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.

• Lenovo ThinkPlus FU100: Gen 1 is affected; other versions are unaffected by default.
• Lenovo ThinkPlus FU200: Gen 1 is affected; other versions are unaffected by default.
• Lenovo ThinkPlus TU800: Gen 1 is affected; other versions are unaffected by default.
• Lenovo ThinkPlus TSD303: Gen 1 is affected; other versions are unaffected by default.

The record does not provide an exact fixed software or firmware boundary. Do not infer that every release after Gen 1 is safe without Lenovo confirmation.

The flaw is in Lenovo ThinkPlus configuration software and is classified as CWE-290: Authentication Bypass by Spoofing. An attacker must be a locally authenticated user with low privileges; no additional interaction from another user is required. The record states that attack requirements are present, but does not describe the specific requirement. The attacker-controlled input is the enrollment of an untrusted fingerprint, which can be used to bypass ThinkPlus device authentication. The available evidence does not disclose whether the implementation error involves validation, state handling, or an update to a trust store. The confirmed affected scope covers ThinkPlus FU100, FU200, TU800, and TSD303 Gen 1 devices.

The vulnerability is locally reachable by an authenticated user with low privileges. The recorded attack characteristics indicate low complexity, no user interaction, and a required attack condition that must be present. The supplied record marks public_exploit as false, and the returned vulnerability enrichment records exploitation as none and automatable as no. These assessments do not prove that undisclosed exploitation is absent.

Successful exploitation could undermine ThinkPlus device authentication by adding an untrusted fingerprint. The record assesses potential confidentiality, integrity, and availability impact to the vulnerable device as high, but does not establish impact beyond that device. The practical consequence depends on which functions are protected by fingerprint authentication and what access the device grants after authentication. The prerequisite of local authenticated access means this is not described as an independent remote network attack path.

An attacker who already has local access and a valid authenticated account could enroll an untrusted fingerprint on a ThinkPlus device. Depending on how the device uses fingerprint authentication, this could permit unauthorized access to protected functions or data. A changed authentication mechanism can also weaken access controls and disrupt trusted device operation. The available evidence does not confirm a breach, a specific data loss event, or an active attack campaign.

1. Apply Lenovo's remediation: Lenovo states that it has released a hardware-level solution and offers affected users a free after-sales upgrade.
2. Contact Lenovo support to validate the device serial number and obtain instructions for replacement or an on-site firmware upgrade. The available evidence does not name an exact fixed firmware version, so one should not be inferred.
3. Before sending a device for upgrade, back up important data and fully delete or format the device as directed by Lenovo to remove stored data.
4. After remediation, confirm the device status and review the enrolled fingerprints. If immediate remediation is not possible, restrict local access and configuration-software use to the minimum necessary, recognizing that this is only a temporary mitigation.

1. Inventory Lenovo ThinkPlus FU100, FU200, TU800, and TSD303 devices, with particular attention to devices identified as Gen 1.
2. Reconcile each device serial number with Lenovo support to determine whether the hardware-level remediation or firmware upgrade has been applied.
3. Inspect the fingerprints enrolled on affected devices and investigate any fingerprint that was not approved by the device owner or administrator.
4. Review local authentication and configuration-change records where available. This is precautionary because Lenovo has not published a specific log event or IOC for this vulnerability.
5. Do not treat the absence of an unexpected fingerprint or related log evidence as proof that a device is safe.