Vulnerability · Published Nov 12, 2025 · Assigned by lenovo
CVE-2025-10495
High 7.5
In plain English
A high-severity improper certificate validation in App Store from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | App Store | 0 – before 9.0.2530.1027 |
| Lenovo | PC Manager | 0 – before 5.1.140.9262 |
| Lenovo | Browser | 0 – before 9.0.6.9111 |
| Lenovo | Legion Zone | 0 – before 2.0.21 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H