description: An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
product: Legion Phone Pro (L79031)
vendor: Lenovo
versions:
lessThan: 12.5.231, status: affected, version: unspecified, versionType: custom
}
{
product: Legion Phone2 Pro (L70081)
vendor: Lenovo
versions:
lessThan: 12.5.632, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: For Legion Phone Pro (L79031), perform an Over-The-Air (OTA) system update to version 12.5.231 (or later).
For Legion Phone2 Pro (L70081), perform an Over-The-Air (OTA) system update to version 12.5.632 (or later).
To check for available updates wirelessly/over-the-air: # Go to Settings > My Phone > System Update
If an update is available, follow the instructions on your phone to download and install it.
Once updated, your phone will restart to complete the installation.