A Fingerprint USB Drive Promised AES-256. Inside Was a Plain SD Card.

November 1 — According to the outlet HackingPassion this week, USB drives from five manufacturers — Lenovo, Netac, KakaSoft, Nexcopy and Yutian Dun — have been found to have security flaws. One Lenovo fingerprint USB drive claims AES-256 hardware encryption, but actually stores data in plain text on an SD card.

Researcher Xusheng Li took apart Lenovo’s ThinkPlus FU100 fingerprint USB drive last year and found an SD card on the internal circuit board, with data stored entirely in plain text and no encryption at all. The fingerprint reader in fact only decides whether the drive connects to the computer; files on the card are not protected by it.

After the researcher reported the problem to Lenovo in August last year, the company prepared a stopgap: covering the SD card with a layer of epoxy to make it harder to remove. A proper fix followed in December.

Lenovo’s ThinkPlus TSD303 fingerprint external SSD has a flaw too. It uses a standard-size M.2 SSD inside and its data really is encrypted. But when the Lenovo program on the computer asks for the password, the drive returns the correct password in plain text over the USB cable. Anyone who can monitor the traffic or read the program can obtain the password.

Three months after the report, Lenovo sent a test fix. In the new version the drive no longer sends the password in plain text but sends encrypted data. The researcher first assumed it might be a hash of the password, then used a debugger to trace where the data came from and found it came from the SM4 cipher — a block cipher similar to AES — with a key generated from a number that looks like a timestamp.

In testing, that key was 2021012700000000 and could be recovered with decryption tools. That means Lenovo’s fix is incomplete, because the program itself can derive the key — and so can anyone who takes the program apart.

Lenovo published security advisory LEN-210545 on 13 January 2026, rated high severity, listing three CVE numbers:

CVE-2025-13453: some ThinkPlus USB drives have a flaw that lets someone with physical access read the data stored on them.

CVE-2025-13454: the ThinkPlus configuration software has a flaw that lets a locally logged-in user access sensitive device information.

CVE-2025-13455: the configuration software has a flaw that lets a locally logged-in user bypass device authentication and register untrusted fingerprints.

FU100 owners should call Lenovo China’s service line on +86 400-640-1886 to request a free upgrade; Lenovo will check the serial number and arrange for the device to be sent in for replacement, or send staff to update the firmware on site.

A second fix for the TSD303 arrived in December 2025, in which the drive verifies the password itself.