Lenovo Thinkplus TSD303 Firmware vulnerabilities

3 CVEs affecting Lenovo Thinkplus TSD303 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13455, published 2026-01-14.

More from Lenovo.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-13453, published 2026-01-14. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.
• CVE-2025-13455, published 2026-01-14. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.
• CVE-2025-13454, published 2026-01-14. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information.