CVE-2025-13455 Auth bypass in ThinkPlus FU100

High 7.3 Published 14 Jan 2026 Updated 15 Jan 2026

A local authenticated user can bypass device authentication to enroll an untrusted fingerprint on Lenovo ThinkPlus devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-13455?

CVE-2025-13455 is a high-severity authentication bypass vulnerability in Lenovo ThinkPlus FU100, published on 14 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.

Weakness: CWE-290

Which versions are affected by CVE-2025-13455?

It affects 4 products.

Products include Lenovo Thinkplus Fu100 Firmware, Lenovo Thinkplus Fu200 Firmware, Lenovo Thinkplus Tsd303 Firmware, Lenovo Thinkplus Tu800 Firmware.

How do I fix CVE-2025-13455?

No fix has been published for CVE-2025-13455 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-13455 being exploited?

There is no known exploitation of CVE-2025-13455 in the wild and no public exploit code.

Sources

Also known as GHSA-7mvg-mpxf-p5cf.