CVE-2023-5080 is a medium severity (CVSS 6.8) privilege escalation in some Lenovo tablets, including the Tab M8 HD TB8505F and TB8505FS. Local applications could get access to device identifiers and system commands. Check Lenovo advisory LEN-142135 for the fixed software and update the tablet.
What's affected
The NVD record says a privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands. It lists the Lenovo Tab M8 HD models TB8505F and TB8505FS and their firmware.
The record does not give a fixed software version. Its reference is the Lenovo product security advisory LEN-142135. That page blocked automated access when we reviewed this entry, so we cannot confirm which update fixes the issue or which other tablet models are covered. Open the advisory and read the affected product table for your exact model and region.
The attacker in this case is an app that is already installed on the device, not a remote party. That is why the score is medium.
How to check if you're exposed
On the tablet, open Settings, then About tablet, and note the model number and the software or build version. Check for a security patch level too.
Compare these with the fixed version in the Lenovo advisory. If the tablet is not listed, or no update exists for it, assume it stays exposed.
Look at the apps installed on the device. The risk comes from local apps, so unknown or sideloaded apps deserve a second look.
For managed fleets, use your mobile device management tool to report model, build and patch level for all Lenovo tablets.
What to do now
- Find Lenovo Tab M8 HD tablets in your estate, in kiosks, classrooms, shops and field use.
- Read advisory LEN-142135 and install the update it names.
- Remove apps that are not needed, and allow installs only from trusted stores.
- Avoid keeping sensitive work data on tablets that cannot be updated.
- Plan replacement for devices that no longer receive security updates.
Why it matters
The record maps this to CWE-266, incorrect privilege assignment. An app gets access to information and commands that the platform should keep for system components, which weakens the app sandbox.
Device identifiers are used for tracking and for tying activity to a device, and system commands are powerful on their own. Low cost tablets often get fewer updates, so the practical risk is a device that never receives the patch. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Can this be attacked over the network?
The record describes local applications. An attacker would need an app running on the device, for example one the user installed.
Sources
Last reviewed: 19 October 2026.
