By Tsuky 
The Lenovo ThinkPlus FU100 appeared to offer several reassuring security features.
It combined a fingerprint reader with marketing claims about AES encryption and protected storage areas.
For someone transporting confidential files, the combination could suggest stronger protection than an ordinary USB drive.
But security researcher Xusheng Li discovered a fundamental problem when examining the hardware.
Inside the device was a removable memory card containing unencrypted data.
The fingerprint reader controlled access through the normal USB connection, but the stored files themselves were not protected by the expected encryption.
That distinction meant a person with physical access to the device could potentially bypass the biometric mechanism by accessing the underlying storage directly.
The investigation returned to the headlines on November 1, 2026, alongside additional research into weaknesses affecting other storage-security products.
The initial Lenovo finding, however, was not new. It had been reported to the company in 2025 and addressed in a security advisory published in January 2026.
The fingerprint reader controlled access, not encryption
The central issue involves the difference between authentication and data encryption.
Authentication determines whether a person is permitted to use a device through its normal interface.
Encryption transforms stored information so that it cannot be read without the appropriate cryptographic key.
A properly encrypted storage device should not reveal readable files merely because someone physically removes its memory component.
In the FU100 examined by Li, biometric authentication primarily controlled whether the internal storage was connected over USB.
The underlying data remained readable without the expected cryptographic protection.
This is not the same as finding a way to fool the fingerprint sensor.
Even a highly accurate biometric reader cannot protect unencrypted files when an attacker bypasses the reader entirely.
The weakness therefore concerned the storage architecture rather than a simple fingerprint-recognition error.
Lenovo advertised AES-based protection
Lenovo's official product materials described the FU100 as combining AES data encryption with fingerprint-based access control.
The product also supported configurations involving public and protected storage areas.
Such features suggest that the device provides multiple layers of security.
Li's research called the most important of those layers into question.
The finding does not mean that the AES cryptographic algorithm itself was broken.
The researcher did not need to discover a mathematical weakness in AES-256 to obtain readable data.
The problem was more basic: the examined storage content had not been encrypted as expected.
That is an important lesson for buyers.
A robust cryptographic algorithm does not guarantee a secure product if the device fails to apply the algorithm correctly.
Security also depends on key management, implementation details and the relationship between authentication and stored information.
The original discovery dates back to 2025
Xusheng Li, associated with reverse-engineering company Vector 35, investigated the FU100 during 2025.
According to HackingPassion's account, he reported the issue to Lenovo in August of that year.
An interim response reportedly involved covering the internal memory card with epoxy resin to make physical removal more difficult.
Such a measure can complicate hardware disassembly.
However, epoxy is not a cryptographic substitute for encryption.
A physical barrier may slow an attacker, but it does not make files unreadable if the underlying memory can eventually be accessed.
Li subsequently presented his research at the RE//verse 2026 conference in March.
The case therefore developed through several distinct stages: technical discovery, responsible reporting, remediation efforts, the formal security advisory and renewed public attention.
The November 1 coverage represents that later reporting stage rather than the date of the original discovery.
Lenovo's advisory identifies four affected models
Lenovo published security advisory LEN-210545 in January 2026.
The notice lists the initial revision date as January 13, with publication in Lenovo's Chinese knowledge base on January 14.
The company classified the issues as high severity.
Four products appear in the advisory: ThinkPlus FU100, ThinkPlus FU200, ThinkPlus TU800 and ThinkPlus TSD303.
Three CVE identifiers are associated with the notice.
CVE-2025-13453 concerns the possibility of reading stored data from certain devices when an individual has physical access.
CVE-2025-13454 concerns sensitive information exposure through the configuration software to an authenticated local user.
CVE-2025-13455 concerns a potential bypass of device authentication and enrollment of an unauthorized fingerprint by an authenticated local user.
These vulnerabilities are not interchangeable.
The inclusion of four products in one advisory does not prove that every listed model uses the same unencrypted internal memory arrangement as the examined FU100.
Different devices can have different implementation flaws.
Remediation may require replacement or service intervention
Lenovo says it has released a hardware-level solution for the affected products.
The company offers a free remediation process after verifying the device's serial number.
Depending on the product and circumstances, the customer may be instructed to return the device for replacement or arrange an on-site firmware intervention.
The official Chinese advisory provides the service number +86 400-640-1886.
That number refers to the Chinese support arrangement, not necessarily a universal international service channel.
Customers in other regions should contact the appropriate Lenovo support organization for applicable instructions.
The advisory does not establish that installing an ordinary operating-system update automatically resolves the problem.
Lenovo recommends backing up important files and strongly advises wiping or formatting storage before sending a device for service.
That precaution is especially relevant when potentially sensitive information may not be protected by effective encryption.
The ThinkPlus TSD303 SSD had a different weakness
Li's research also examined the Lenovo ThinkPlus TSD303 external SSD.
Unlike the FU100 example, this device did encrypt its stored data.
The weakness involved the handling of the correct authentication password.
According to the technical investigation, the device could transmit the correct password back to the computer in plaintext so that local software could compare it with the user's input.
An actor capable of monitoring that exchange could potentially obtain the secret.
Encryption of the underlying storage was therefore undermined by the authentication process.
The reported remediation process involved multiple iterations.
An intermediate approach was criticized for weak key management.
A later change moved password verification onto the device itself, avoiding the need to send the correct password to the host computer.
The case illustrates why stored-data encryption and authentication security must both be considered.
Other products shared vulnerable software designs
The researcher also investigated several storage devices that used related software components.
The results revealed weaknesses involving password transmission, encryption and local authentication.
Some products exposed passwords in readable form.
Others used unencrypted memory or cryptographic arrangements that made supposedly protected information recoverable.
These findings suggest that an insecure software development kit can spread similar vulnerabilities across multiple products.
However, the published research does not provide sufficient evidence to assign every identified failure to every product or brand mentioned.
A weakness in a specific implementation must not be generalized to all biometric storage devices.
Assessing the actual affected models remains essential.
AI-assisted analysis contributed to the follow-up research
The renewed coverage also highlights the use of AI tools in some of Li's later investigations.
He used OpenAI Codex alongside specialized reverse-engineering software to analyze protection mechanisms.
One example involved software from Netac.
According to the report, the analysis quickly identified a fixed cryptographic key embedded in the program and diagnostic records containing sensitive information.
Other investigations covered KakaSoft USB Copy Protection and Nexcopy Copy Secure.
For the KakaSoft product, the researcher reported reconstructing the protection mechanism in less than half an hour.
The Nexcopy analysis identified cryptographic material available through the viewing software.
These findings do not demonstrate that AI can automatically break every encryption system.
They show that programming assistants can accelerate selected code-analysis tasks when combined with specialist tools and human expertise.
Technical validation remains essential, especially when automated analysis produces hypotheses about unfamiliar software.
Hidden accounts do not automatically establish malicious intent
The broader research also identified hidden accounts in SecZure's YutianDun product.
They were found through advanced debugging and execution analysis.
Such mechanisms can create serious security risks when credentials are weak, shared or predictable.
However, their existence does not by itself prove deliberate malicious intent by the manufacturer.
Maintenance mechanisms, development mistakes and poor design choices can produce similar vulnerabilities.
The existence of a hidden access mechanism and the motivation behind its inclusion are separate investigative questions.
The available evidence should be described accordingly.
Why biometric security claims need verification
Fingerprint readers can be useful security components.
They simplify authentication and may reduce reliance on repeatedly typed passwords.
However, their presence says little about how data is actually stored.
A device can authenticate users while leaving files unencrypted.
Another device may encrypt stored information correctly but mishandle the secret used to unlock it.
A third may implement both functions securely while still exposing vulnerabilities through its management software.
These mechanisms require separate evaluation.
The presence of an AES-256 logo or claim on a product page does not establish how keys are generated, stored or used.
For sensitive information, buyers should look for verifiable security architecture, appropriate certifications and independent technical assessments where available.
Physical loss or theft is the central risk
The FU100 vulnerability is particularly relevant when an unauthorized person obtains physical possession of the device.
A USB drive may be lost during travel, stolen with a bag or left unattended in an office.
If its files are unencrypted, direct access to the memory can bypass authentication features built into the outer enclosure.
The primary consequence is a loss of confidentiality.
A remote operating-system attack is not necessary to understand the seriousness of that weakness.
However, the available reports do not establish that a large-scale campaign has exploited the vulnerability to steal user data.
A demonstrated technical weakness and confirmed malicious exploitation are separate facts.
Organizations should review their storage inventories
Businesses using removable storage should begin by identifying the exact models deployed.
A product-family name is not necessarily sufficient because individual devices may have different internal architectures.
Administrators should record model numbers and serial numbers, then check applicable security advisories.
For Lenovo's affected devices, LEN-210545 identifies the relevant product references.
The next step is to determine the appropriate remediation procedure for each unit.
Devices containing confidential information may require priority handling.
Important data should be backed up before service or replacement.
Organizations should also consider whether any affected device was lost, stolen or left outside their control.
Continued operation of a fingerprint reader is not evidence that the storage remains secure.
What FU100 owners should do
Owners should first confirm the exact model of their device.
If it is listed in Lenovo's advisory, they should contact the appropriate Lenovo support channel to verify the available fix or replacement procedure.
Until remediation is confirmed, users should avoid treating the affected drive as the sole protection for highly confidential information.
Important files should be backed up to trusted storage.
Moving sensitive information to a properly encrypted device may be appropriate.
However, moving files today cannot determine whether someone previously accessed them while the original device was outside the owner's control.
If exposure is suspected, organizations should follow their incident-response procedures.
Replacing a vulnerable device does not retroactively eliminate any earlier disclosure of information.
The lesson extends beyond Lenovo
This investigation does not establish that every biometric USB drive is insecure or that hardware encryption is inherently ineffective.
It demonstrates that products can make compelling security claims while failing to implement the expected protection correctly.
The FU100 was especially problematic because the biometric reader could create an appearance of confidentiality that did not survive physical access to the internal memory.
The broader research also identifies risks involving exposed passwords, hardcoded cryptographic keys and insecure configuration software.
AI-assisted reverse engineering may make it faster for researchers to identify such weaknesses in proprietary implementations.
That development increases the value of sound cryptographic design, independent verification and documented security responses.
Lenovo's existing advisory provides affected customers with a concrete starting point for remediation.
The wider principle is straightforward: biometric authentication can control access to a device, but only properly implemented encryption can protect stored information when the physical storage itself falls into the wrong hands.