Security researchers have uncovered critical vulnerabilities across encrypted USB drives from Lenovo, Netac, and 3 other storage brands. Independent teardowns revealed that Lenovo ThinkPlus fingerprint drives advertised with AES 256 hardware encryption actually store files completely unencrypted on internal SD cards. Lenovo has issued high severity security advisories alongside hardware replacement programs for affected customers.
Hardware analysis conducted by security researcher Xusheng Li and reported by cybersecurity outlet HackingPassion exposed the internal architecture of the Lenovo ThinkPlus FU100 fingerprint USB drive. Inside the plastic shell, the unit relies on a standard micro SD card with zero file encryption. The fingerprint scanner does not scramble or protect data, serving merely as an electrical switch that connects the storage card to the host PC. Anyone who opens the outer casing can remove the card and read all files on any standard computer. Lenovo initially responded to the vulnerability report by covering the internal memory card in epoxy resin to make extraction harder, followed by a formal replacement program.
A companion investigation into the Lenovo ThinkPlus TSD303 fingerprint external SSD revealed flawed cryptographic communication between the drive and the computer. While this model does encrypt files on an internal M.2 solid state drive, the companion management software handles unlock credentials insecurely. When host applications requested access, the drive returned the plaintext unlock password across the USB cable. An initial firmware fix attempted to encrypt this exchange using the SM4 cipher, but the system used a predictable key derived from a timestamp that researchers cracked in minutes. A second firmware revision resolves the flaw by forcing the storage hardware to verify passwords entirely on the local controller.
Lenovo published security advisory LEN 210545 to address 3 specific flaws designated CVE 2025 13453, CVE 2025 13454, and CVE 2025 13455. The listed vulnerabilities permit physical data theft, local software privilege abuse, and authentication bypasses that let local users enroll unauthorized fingerprints. Owners of the ThinkPlus FU100 drive can contact regional customer support lines at +86 400 640 1886 to request hardware swaps or schedule on site firmware updates. Netac, KakaSoft, Nexcopy, and Yutiandun also face scrutiny as researchers expand testing across consumer storage claiming biometric protection.
