A serious security vulnerability has been uncovered affecting several USB drives, including models from Lenovo, leveraging fingerprint recognition for purported data security. Research indicates that some Lenovo ThinkPlus drives, advertised with robust AES-256 hardware encryption, were found to store sensitive data in plain text on an SD card hidden within the device.
ThinkPlus FU100: Fingerprint Lock, Plain Text Data
The issue was brought to light by researcher Xusheng Li, who in a dissection of the Lenovo ThinkPlus FU100 fingerprint recognition USB drive last year, discovered an SD card soldered onto the circuit board. Alarmingly, all data on this card was stored unencrypted. The fingerprint sensor, it turned out, merely acted as a switch to enable or disable the connection to the computer, offering no actual protection to the files stored on the SD card.
Upon reporting the vulnerability to Lenovo in August of last year, the company initially proposed a temporary fix: covering the SD card with epoxy resin to make physical removal more difficult. A more permanent solution was slated for release in December of the same year.
ThinkPlus TSD303 SSD: Password Leakage via USB
The security concerns extend to Lenovo’s ThinkPlus TSD303 external SSD, which also features fingerprint authentication. While this device employs a standard M.2 SSD and does encrypt its data, a critical flaw was identified in its password handling. When the Lenovo software on a computer requested the password, the drive would transmit it in plain text over the USB connection. This meant anyone monitoring the USB communication or accessing the software could easily obtain the password.
Approximately three months after the initial vulnerability report, Lenovo provided a test version of a software patch. In this revised version, the drive no longer sent the password in plain text but instead transmitted encrypted data. Initial analysis suggested this might be a hashed password. However, further investigation using a debugger revealed the true origin of this data: it was derived using the SM4 encryption algorithm, a block cipher similar to AES. The key used for this encryption was generated from a value resembling a timestamp.
During testing, a key value of 2021012700000000 was used, which, when decrypted, successfully revealed the password. This indicated that the fix was incomplete, as the software itself could derive the key, meaning an attacker who could reverse-engineer the software would also be able to extract the key and decrypt the data.
Lenovo’s Response and CVE Details
Lenovo has since issued a security advisory, LEN-210545, on January 13, 2026. The vulnerabilities have been classified as high severity and assigned three CVE numbers:
- CVE-2025-13453: Affects certain ThinkPlus USB drives, allowing individuals with physical access to the device to read stored data.
- CVE-2025-13454: A vulnerability in the ThinkPlus configuration software that could allow a locally logged-in user to access sensitive device information.
- CVE-2025-13455: Another configuration software flaw enabling a locally logged-in user to bypass device authentication and register untrusted fingerprints.
Users of the FU100 fingerprint recognition USB drive are advised to contact Lenovo China’s service hotline at +86 400-640-1886 to arrange a free upgrade. Lenovo will verify the device’s serial number and coordinate either shipping the device back for replacement or scheduling an on-site firmware upgrade.
A second revised solution for the TSD303 was released in December 2025, which includes self-verification of passwords by the drive itself.
