An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier.
Description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Metrics
Version
Base score
Base severity
Vector
3.1
3.3
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Version:3.1
Base score:3.3
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Update to the version (or newer) indicated for your model in the Product Impact section in the advisory:
https://support.lenovo.com/us/en/product_security/LEN-142135
Configurations
Workarounds
Exploits
Credits
finder
Lenovo thanks Ryan Johnson and Mohamed Elsabagh of Quokka for reporting this issue.