Security researcher Xusheng Li discovered critical vulnerabilities in Lenovo ThinkPlus fingerprint-enabled storage devices. The ThinkPlus FU100 USB drive, marketed with AES-256 hardware encryption, stores data in plaintext on an internal SD card. The fingerprint sensor only controls the physical connection to the computer, failing to protect the actual files stored on the device.
Lenovo initially attempted a temporary fix for the FU100 by covering the SD card with epoxy resin to prevent physical removal. A formal update was released in December 2024. Users are advised to contact Lenovo China support at +86 400-640-1886 to arrange for a free device replacement or firmware upgrade after serial number verification.
The ThinkPlus TSD303 external SSD also contained a flaw where the device transmitted passwords in plaintext over USB. While a subsequent patch replaced this with SM4 encryption, the key was derived from a predictable timestamp-like value, allowing for decryption. A second, more secure patch was released in December 2025 that enables the drive to perform internal password verification.
Lenovo issued security advisory LEN-210545 on January 13, 2026, assigning a high-risk rating to these vulnerabilities. The advisory covers three CVE identifiers: CVE-2025-13453, which relates to unauthorized data access; CVE-2025-13454, involving sensitive information exposure; and CVE-2025-13455, which allows attackers to bypass authentication and register unauthorized fingerprints.
