CVE-2025-10495 HIGH

CVE-2025-10495

Vendor Lenovo
Product App Store
Weakness CWE-295
Published November 12, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.

Key dates

02Disclosure timeline

November 12, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-11043 Improper Server Certificate Validation in Automation Studio CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations CVE-2016-6562 ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections CVE-2024-23928 Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation