Sensitive health information exposure in Lenovo Health Android Application

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.

• Lenovo Health Application for Android: the CNA structured affected data marks the version range beginning at 0 and ending at 1.5.0, including 1.5.0; the default status outside that stated range is unaffected.
• The Lenovo application described by the record is distributed exclusively in the Chinese market, and Lenovo's advisory identifies tablets as the applicable device type.
• Lenovo's solution states that the application should be updated to 1.5.0 or later. This conflicts at the boundary with the structured affected data, which includes 1.5.0; do not automatically treat 1.5.0 as fixed without confirming the boundary with Lenovo.
• The available evidence does not support extending the affected scope to other Lenovo products or other Android release branches.

Lenovo Health Android Application is classified under CWE-798, Use of Hard-coded Credentials, indicating that hard-coded authentication material is present in the application or a related component. The supplied assessment indicates network reachability, low attack complexity, no required prior privileges, and no user interaction. The stated outcome includes access to sensitive health information and an integrity impact on data handled by the application, while no availability impact is indicated. The record does not disclose the credential location, authentication flow, endpoint, attacker-controlled parameter, specific Android component, or request sequence required for exploitation. The high-level access conditions are therefore supported, but a concrete exploit path cannot be described from the available evidence.

The vulnerability is described as reachable over the network with low complexity, no required prior authentication or privileges, and no user interaction. The normalized record marks public_exploit as false, while the consulted CISA enrichment records exploitation as none and assesses the issue as automatable. No exploit code, endpoint, payload, campaign, or specific indicator of compromise is identified in the available record or advisory. These statuses do not prove that exploitation is impossible or exclude undisclosed abuse.

A successful attack could disclose sensitive health-related information and, according to the supplied assessment, could affect the integrity of information handled by the application. The described conditions are network-based, require no prior privileges, and require no user interaction, so devices running an affected version should receive priority for review. The record does not indicate an availability impact or expansion of the vulnerability's scope into another system. The practical consequences depend on the data stored or exchanged by the application and whether it is active on an affected device.

The vulnerability could permit unauthorized access to sensitive health information handled by the application, creating privacy, compliance, and user-trust risks. The supplied technical assessment also indicates a potential integrity impact, so organizations should not limit review to possible data disclosure. The record does not provide evidence of a confirmed disclosure, data modification, campaign, or named incident. Actual exposure should be determined through version inventory and appropriate telemetry review.

1. Follow Lenovo's remediation by updating Lenovo Health Android Application to 1.5.0 or later.
2. Because the structured affected data still marks 1.5.0 as affected, confirm with Lenovo that the release selected for deployment is actually corrected before closing the issue. Do not infer the status of 1.5.0 from only one of the conflicting records.
3. If the update cannot be completed, contact Lenovo for a supported mitigation. The available record does not provide a specific workaround, so unsupported configuration changes should not be substituted.
4. After deployment, refresh the device inventory to record the application version on each device and continue reviewing unusual access activity where appropriate.

1. Inventory Lenovo tablets distributed or used in the Chinese market and identify devices with Lenovo Health Android Application or Health Application installed.
2. Record the installed application version through inventory, MDM, or direct device inspection. The structured affected data marks versions from 0 through 1.5.0 as affected.
3. Treat the status of 1.5.0 as requiring confirmation. The structured affected data includes 1.5.0, while Lenovo's solution says to update to 1.5.0 or later.
4. Review network telemetry for anomalous connections associated with the application as a precaution, but note that the record provides no known endpoint, log event, or IOC.
5. Do not treat the absence of suspicious logs as proof that a device is unaffected or that health information was not accessed.