CVE-2025-13455: ThinkPlus Authentication Bypass Flaw

CVE-2025-13455 Overview

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint. This authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) enables attackers with local access to circumvent biometric security controls, potentially compromising the integrity of fingerprint-based authentication systems.

Critical Impact

Local authenticated attackers can bypass device authentication mechanisms and enroll unauthorized fingerprints, undermining the security of biometric access controls on affected ThinkPlus devices.

Affected Products

• ThinkPlus Configuration Software (specific versions not disclosed)
• Lenovo ThinkPlus devices utilizing fingerprint authentication
• Systems running vulnerable ThinkPlus biometric enrollment software

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-13455 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-13455

Vulnerability Analysis

This vulnerability falls under CWE-290 (Authentication Bypass by Spoofing), indicating that the ThinkPlus configuration software fails to properly validate authentication credentials or identity verification during the fingerprint enrollment process. The flaw allows a local authenticated user to circumvent the normal authentication workflow that should prevent unauthorized biometric enrollment.

The attack requires local access to the system and the attacker must already have some level of authentication on the device. However, once these prerequisites are met, the attacker can exploit the authentication bypass to enroll fingerprints that should not be trusted by the system. This could enable an attacker to gain persistent unauthorized access to the device through biometric authentication, effectively creating a backdoor that bypasses intended security controls.

Root Cause

The root cause of this vulnerability lies in improper authentication verification within the ThinkPlus configuration software's fingerprint enrollment functionality. The software fails to adequately verify that the user initiating a fingerprint enrollment operation has the proper authorization level to perform such sensitive actions. This authentication bypass by spoofing allows attackers to impersonate authorized users or bypass the authentication checks entirely during the enrollment process.

Attack Vector

The attack vector is local, requiring the attacker to have physical or remote authenticated access to the affected system. The exploitation scenario involves:

1. An attacker gains local authenticated access to a system running vulnerable ThinkPlus configuration software
2. The attacker initiates the fingerprint enrollment process
3. Due to improper authentication validation, the software accepts the enrollment request without proper authorization verification
4. The attacker successfully enrolls an untrusted fingerprint
5. The enrolled fingerprint can subsequently be used to authenticate to the device, bypassing intended access controls

The vulnerability does not require user interaction beyond the attacker's own actions, and the attack complexity is considered low once local access is achieved. For detailed technical information, refer to the Lenovo Security Advisory.

Detection Methods for CVE-2025-13455

Indicators of Compromise

• Unexpected fingerprint enrollment events in system logs without corresponding authorized user sessions
• Multiple fingerprint enrollments from the same user account in a short time period
• Fingerprint enrollment attempts occurring outside normal business hours or from unusual system accounts
• Audit log entries showing fingerprint database modifications without proper authorization workflows

Detection Strategies

• Monitor ThinkPlus configuration software logs for fingerprint enrollment events and correlate with authorized user activity
• Implement endpoint detection rules to alert on unauthorized access to biometric enrollment APIs or configuration files
• Deploy behavioral analytics to detect anomalous patterns in biometric enrollment activities
• Review Windows Event Logs for suspicious activity related to ThinkPlus services and fingerprint reader interactions

Monitoring Recommendations

• Enable verbose logging for ThinkPlus configuration software and biometric subsystems
• Establish baseline metrics for normal fingerprint enrollment patterns and alert on deviations
• Integrate ThinkPlus logs with SIEM solutions for centralized monitoring and correlation
• Regularly audit enrolled fingerprints against authorized user lists to detect unauthorized enrollments

How to Mitigate CVE-2025-13455

Immediate Actions Required

• Review and apply the latest security updates from Lenovo for ThinkPlus configuration software
• Audit all enrolled fingerprints on affected systems to identify potentially unauthorized entries
• Restrict local access to systems with ThinkPlus software to only essential personnel
• Implement additional access controls and multi-factor authentication where possible

Patch Information

Lenovo has released security information regarding this vulnerability. Organizations should consult the Lenovo Security Advisory for specific patch availability and remediation guidance. Apply all recommended updates to the ThinkPlus configuration software as soon as they become available.

Workarounds

• Disable or restrict access to the fingerprint enrollment functionality until patches can be applied
• Implement strict access controls limiting which users can access ThinkPlus configuration software
• Use group policy or endpoint management tools to prevent unauthorized execution of enrollment processes
• Consider temporarily disabling biometric authentication in favor of alternative authentication methods in high-security environments

# Example: Restrict ThinkPlus configuration software access (Windows)
# Review and modify file permissions on ThinkPlus installation directory
icacls "C:\Program Files\Lenovo\ThinkPlus" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F"

# Disable the ThinkPlus service if fingerprint enrollment is not required
sc config "ThinkPlusService" start= disabled