Japan's vulnerability portal JVN, run by JPCERT/CC and IPA, published advisory JVN#33436631 on October 20, 2026. It says multiple Lenovo tablets shipped with "a known private test key" for Android Verified Boot (AVB), tracked as CVE-2026-92777. According to JVN, an attacker with physical access to an affected tablet can install a crafted system image. JVN tells users to update to the latest firmware, and to stop using models whose support has ended because they will not get fixes. It lists Lenovo's own advisory, LEN-221035.

The Lenovo advisory follows a related disclosure six days earlier. On October 14, JVN#47427200 (CVE-2026-107153) reported the same class of problem in four Rakuten Mobile smartphones. Those phones will not get a fix. Neither JVN advisory describes active exploitation, and CISA's SSVC assessments in the NVD records list exploitation as "none" for both CVEs. Both advisories credit the same reporter, Masayoshi Matsubara, who reported the issues to IPA. Both cite the same academic research.

What a test key does to Verified Boot

Android Verified Boot checks that the software a device loads is signed by a trusted key. The Android Open Source Project (AOSP) ships test keys for development. Their private halves are public, so they are not meant to protect production firmware. JVN says the affected Rakuten phones "utilize AOSP test keys for their Android Verified Boot (AVB) functionality." JVN's Lenovo advisory uses the same "known private test key" wording in English; its Japanese-language version says the tablets use the test keys published by AOSP as-is.

The research behind both advisories is a paper titled "AVBTestKeyInTheWild: Bypassing Android Verified Boot Using A Firmware Supply Chain Vulnerability on Locked Devices." Its authors are E. Leierzopf, S. Kempinger, R. Mayrhofer and M. Roland, and it appeared at SPICES 2025, the ACM Workshop on Security and Privacy in Connected Embedded Systems. The paper describes a firmware supply-chain weakness that lets attackers flash modified firmware onto locked devices without wiping user data. The authors trace it to weak signing practices, such as shipping AOSP test keys in production firmware, and say it affects multiple manufacturers and System-on-Chip vendors. They say the issue bypasses Verified Boot and exposes limits in key attestation. They also say affected devices likely cannot be fixed. The researchers coordinated disclosure with Google and the affected manufacturers under a 90-day response window. They propose detection methods and stricter signing, attestation and testing practices.

Lenovo: two sources, two severity ratings

JVN and Lenovo describe and score CVE-2026-92777 differently.

  • JVN (JVN#33436631) classifies the flaw as CWE-1391, Use of Weak Credentials. It scores it CVSS v4.0 7.0 (AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS v3.0 6.6 (AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
  • Lenovo PSIRT is the CVE Numbering Authority (CNA) for its own products, and the record it filed appeared in NVD on October 16. Lenovo scores the flaw CVSS 4.0 5.4 MEDIUM (AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 6.4 MEDIUM (AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and it assigns CWE-1394. Lenovo's description reads: "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."

Both sets of vectors require physical access, but the other metrics differ. JVN's vectors assume low privileges and low attack complexity. Lenovo's assume no privileges, and they set attack requirements to "present" (CVSS 4.0) and attack complexity to high (CVSS 3.1). Lenovo's description refers to an unlocked tablet. JVN's describes no device state. As of October 20, 2026, NVD lists the record as Awaiting Analysis, and NIST has not published its own score.

Affected Lenovo models and fixed builds

Lenovo's CNA record in NVD lists affected models in the Idea Tab, Legion Tab, Tab M, Tab K, Tab P, Tab Extreme, Tab One, Tab Plus, Tab with Clear/Folio Case and Yoga Tab lines. Each entry gives a build number below which the device is affected. The entries include:

ModelMachine typeAffected below build
Idea Tab ProTB373FU17.5.10.057
Idea Tab / Tab K11 Gen 2TB336FU17.5.10.193
Idea Tab / Tab K11 Gen 2TB336ZU17.5.10.210*
Legion Tab (8.8", 3)TB321FU17.5.10.170
Tab M11TB330FU17.0.135
Tab M11TB330XU17.0.517
Tab ExtremeTB570FU / TB570ZU17.5.382
Tab K11TB330FUP17.0.135
Tab K11TB330XUP17.0.157
Tab K11 PlusTB352FU17.0.10.296
Tab K11 PlusTB352XU17.0.10.284
Tab M10 5GTB360ZU16.0.935
Tab K9 / Tab OneTB305FU17.0.10.216
Tab K9 / Tab OneTB305XU17.0.10.129
Tab P12TB370FU17.0.280
Tab PlusTB351FU17.5.10.199
Tab with Clear/Folio CaseTB311FU17.5.36.302
Tab with Clear/Folio CaseTB311XU17.5.37.216*
Yoga TabTB710FU17.5.04.059
Yoga Tab PlusTB520FU17.5.10.309

*The NVD record contains overlapping entries with different thresholds for two machine types. A combined TB336FU/TB336ZU entry lists 17.5.10.213 instead of 17.5.10.210 for TB336ZU. A combined TB311FU/TB311XU entry lists 17.5.36.302 instead of 17.5.37.216 for TB311XU. Lenovo's advisory LEN-221035 is the vendor's reference for release details. October 16 is when the CVE record appeared in NVD, not necessarily when each firmware build shipped.

Rakuten Mobile: no patch coming

JVN#47427200 (JVNDB-2026-000147) covers the Rakuten Mini, Rakuten Hand, Rakuten Hand 5G and Rakuten BIGs, in all versions. JVN says that with physical access to one of these phones, "a crafted system image may be installed." The advisory uses the same classification and scores as JVN's Lenovo entry: CWE-1391, CVSS 4.0 7.0 and CVSS 3.0 6.6.

There is no fix. The products are no longer supported, and JVN advises: "Stop using the vulnerable products and consider switching to alternatives." NVD tags CVE-2026-107153 as "unsupported-when-assigned" and lists its analysis status as Deferred.

What It Means for Defenders

  • Inventory by machine type, not retail name. Read the TB-prefixed model number on each Lenovo tablet and match it to the table above.
  • Update Lenovo tablets to the latest firmware and confirm the installed build is at or above the threshold for that machine type. For TB336ZU and TB311XU, where NVD's entries conflict, use the build in LEN-221035.
  • Retire the four Rakuten Mobile models. JVN's advice is to stop using them.
  • Tighten physical custody of affected devices until they are updated or retired, and limit unattended access.
  • Check which score your tools use. If you rank patches by CVSS, confirm whether the score comes from JVN or Lenovo, and check again once NVD finishes its analysis.

Sources