CVE-2025-14058 Overview
CVE-2025-14058 is a missing authentication vulnerability [CWE-306] affecting select Lenovo Tablets. An attacker with physical access to a locked device can modify Control Center settings even when the Allow Control Center access when locked option is disabled. The flaw bypasses the lock screen enforcement that should restrict configuration changes to authenticated users.
The issue requires physical proximity and user interaction with the device. Lenovo published advisory LEN-207951 detailing affected models and remediation steps.
Critical Impact
An attacker with physical access to a locked tablet can alter Control Center settings, producing limited integrity and availability impact on the device configuration.
Affected Products
- Select Lenovo Tablet models (see Lenovo advisory LEN-207951)
- Specific model list and firmware versions enumerated by Lenovo
- Devices configured with Allow Control Center access when locked disabled
Discovery Timeline
- 2026-01-14 - CVE CVE-2025-14058 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14058
Vulnerability Analysis
The vulnerability resides in the lock screen enforcement logic that governs access to the tablet Control Center. When a user disables Allow Control Center access when locked, the operating system should prevent Control Center interaction until authentication succeeds. The affected Lenovo Tablets fail to fully honor this restriction.
An attacker with physical access to the locked device can invoke Control Center and modify settings such as toggling wireless radios, brightness, or other exposed quick-action controls. The attack does not yield code execution, data exfiltration, or persistent access. The impact is limited to configuration changes that the lock screen policy was designed to prevent.
This issue is classified under [CWE-306] Missing Authentication for Critical Function. The attack vector is physical, complexity is low, and the operation requires user interaction with the device interface.
Root Cause
The root cause is incomplete enforcement of the lock screen authentication gate for Control Center surfaces. The setting that should block Control Center access is not consistently applied across all entry points, leaving an authentication gap that a local attacker can leverage.
Attack Vector
Exploitation requires physical possession of a locked, vulnerable Lenovo Tablet. The attacker interacts with the lock screen to invoke the Control Center and adjust exposed settings. No network access, credentials, or prior authentication are required. Remote exploitation is not possible.
No verified proof-of-concept code is published. The Lenovo Security Advisory LEN-207951 documents the affected configurations.
Detection Methods for CVE-2025-14058
Indicators of Compromise
- Unexpected changes to Control Center toggles such as Wi-Fi, Bluetooth, or airplane mode on a tablet that was left locked
- Device returning from a locked state with altered brightness, volume, or connectivity settings
- Audit logs showing setting modifications without a preceding successful unlock event
Detection Strategies
- Review device management telemetry for configuration drift on managed Lenovo Tablets
- Correlate Mobile Device Management (MDM) policy compliance reports against expected lock screen behavior
- Monitor for radio state changes on enrolled devices outside of normal user activity windows
Monitoring Recommendations
- Enable MDM logging for Control Center setting changes where supported by the platform
- Track lost or unattended device reports and inspect those devices for unauthorized configuration changes
- Alert on disabled security toggles (such as Find My Device or network connectivity) reported by enrolled tablets
How to Mitigate CVE-2025-14058
Immediate Actions Required
- Apply the firmware update referenced in Lenovo Security Advisory LEN-207951 once available for the affected model
- Inventory Lenovo Tablets within the environment and identify devices matching the advisory
- Educate users to keep tablets in physical custody and report lost or unattended devices promptly
Patch Information
Lenovo addresses this vulnerability through firmware updates distributed for the affected tablet models. Refer to Lenovo Security Advisory LEN-207951 for the current patch status, fixed firmware versions, and model-specific guidance.
Workarounds
- Enforce strong device passcodes and shorten automatic lock timeouts via MDM policy
- Store tablets in secured locations when not in active use to limit physical access
- Use MDM compliance policies to detect and remediate unauthorized configuration drift on enrolled devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
