Lenovo’s stock rose 7.4% on Wednesday despite mounting scrutiny over security flaws in its ThinkPlus FU100 fingerprint USB drives, which reportedly lacked the AES-256 hardware encryption promised in their marketing. While the company announced it has addressed the vulnerabilities, the technical fallout involves critical CVEs and a complex remediation process for users outside the Chinese mainland.
Lenovo Responds to ThinkPlus FU100 Encryption Failures
The security controversy centers on the ThinkPlus FU100, a device marketed as a secure storage solution featuring a fingerprint sensor and hardware-level encryption. However, as reported by windowsforum.com, security researcher Xusheng Li discovered that the FU100’s architecture functioned more like a lock on a door rather than encryption on the files themselves. Instead of an encrypted controller, the device utilized an ordinary SD card. The fingerprint sensor merely acted as a physical switch to enable the USB connection; anyone with physical access could simply remove the SD card to read the unencrypted data.
Lenovo has addressed these claims by stating the affected products were developed specifically for the Chinese mainland.
The vulnerabilities are documented through several high-severity security identifiers. According to windowsforum.com, Lenovo published advisory LEN-210545 on January 13, 2026, which included three specific Common Vulnerabilities and Exposures (CVEs):
- CVE-2025-13453: Allows users with physical access to read data stored on certain ThinkPlus USB drives.
- CVE-2025-13454: Permits a local, logged-in user to access sensitive device information via the configuration software.
- CVE-2025-13455: Enables a local authenticated user to bypass device authentication and enroll untrusted fingerprints, carrying a CVSS 3.1 score of 7.8.
Hardware Vulnerabilities Across the ThinkPlus Lineup
While the FU100 is the primary focus of the encryption failure, the security implications extend to other models in the ThinkPlus ecosystem. The affected hardware includes the FU200, TU800, and TSD303. The TSD303 external SSD presents a different technical failure mode. Unlike the FU100, the TSD303 does contain an M.2 SSD with actual encryption, but it suffered from a critical flaw in its authentication logic. In earlier iterations, the drive would transmit the correct password in plain text over the USB interface to the host software for verification. This allowed anyone capable of monitoring USB traffic or inspecting system memory to intercept the credentials.
Lenovo’s attempted remediation for the TSD303 involved a temporary fix using the SM4 cipher, but researcher Li noted that the implementation remained flawed because the key was derived from a predictable, timestamp-like number. A more durable fix was deployed in December 2025, which moved the password verification process onto the device itself, ensuring the plain-text password never leaves the hardware.
Remediation Challenges for Global Users
For owners of the FU100, the path to security is not a simple software patch. There is no self-service firmware download available for these devices. Instead, users must contact Lenovo’s service line in China. The company’s current protocol involves verifying the serial number and then either replacing the device or performing an on-site firmware upgrade. boerse-express.com notes that this process is particularly cumbersome for users located outside of China. Furthermore, Lenovo advises users to back up and wipe their data before returning devices, a directive that creates a paradox for IT departments tasked with protecting the very sensitive data the drives were purchased to secure.
Lenovo announced on Wednesday that Amar Babu will assume the role of President of Motorola Mobility and Head of the Mobile Business Group, effective January 1, 2027. Until then, Luca Rossi will continue to serve as the interim global President of Motorola through the end of 2026.
The market responded positively to the broader corporate outlook, even as the specific causes for the 7.4% rise in Lenovo’s stock remain unconfirmed by the company. This upward movement coincides with a disclosure to the Hong Kong Stock Exchange noting that Citigroup holds a 5.03% long position in Lenovo, a position established on October 29. Lenovo also reported strong performance during the "Double 11" shopping festival on JD.com, securing 24 category wins within 52 hours and completing updates to Tianxi AI 4.5 across its PC, tablet, and smartphone segments.
Investors looking toward the next major volatility trigger should note that Lenovo is scheduled to release its second-quarter results for the 2026/27 fiscal year on November 19.
