The Lenovo ThinkPlus FU100 was sold as a storage device with AES-256 hardware encryption and fingerprint biometric reading — the concept was straightforward: only someone who places their finger on the sensor can access the files. What security researcher Xusheng Li discovered upon opening the device is that the concept was never implemented: inside the sleek casing lay a plain microSD card with no encryption layer, and the fingerprint reader only toggled the computer's USB connection.
Li, a developer at Vector 35, disassembled the device in 2025 and presented his findings in March 2026 at the RE//reverse conference, with a phrase that sums up the problem: "it's just an SD card in a nice case." The biometric reader controlled the port, not the data. Anyone with physical possession of the device could open the casing and read the files without ever entering a password or placing their finger on the sensor.
Lenovo published advisory LEN-210545 on January 13, 2026, rated high severity. The document lists three CVEs. CVE-2025-13453 describes a vulnerability that allows stored data to be read by someone with physical access to the drive — and the CVE record cites all four affected models: FU100, FU200, TU800, and TSD303. CVE-2025-13454 leaks device information to local users, while CVE-2025-13455 allows someone already authenticated to add a new fingerprint without the owner's authorization.
What makes the case especially concerning is that the FU100 was not the only problem found. Lenovo, in its first response to Li's report on August 27, 2025, applied a makeshift fix: epoxy glue over the SD card to prevent it from being removed. This solution, which one analyst called "security engineering from people who don't understand security," did not encrypt the data — it only made it harder to remove from the device.
Li went beyond the FU100. In October 2026, he connected OpenAI's Codex system to Binary Ninja and analyzed ten other USB security tools from various manufacturers. The results were systematically disappointing. Netac's NetacFileLock tool used a single AES-256 key embedded in the executable, logged passwords in log files, and encrypted only part of each file over 1,024 bytes. KakaSoft's USB Copy Protection tool offered three protection levels: "Normal" merely hid files, "High" XOR'd only the start of each file with a 1-byte key (256 possible keys), and "Maximum," which advertised Blowfish, generated the key from an internal password that Codex recovered in 26 minutes. Nexcopy's Copy Secure used Triple-DES, but the content key lived in a configuration file that any copy of the reader app could open, because the app carried a fixed certificate — Codex needed 10 minutes.
The TSD303, meanwhile, did encrypt its data but failed in another respect: an initial implementation returned the correct password over USB so the companion software could compare it with the user's entry. The first fix, in late 2025, encrypted that communication with a key derived from a predictable timestamp-like value. The second fix, in December 2025, moved the password verification onto the drive itself, so the correct password never left the device again.
Lenovo's proposed resolution for affected customers does not involve a firmware download. The company asks owners to contact its service line in China, where a serial number check decides whether the drive is replaced or upgraded on-site. The company advises backing up and wiping the drive first.
What the case reveals is a broader problem: the growing pressure for affordable security products for enterprise users and consumers who lack the budget for dedicated hardware crypto. Lenovo sold thousands of FU100 units as a security solution — and what it delivered was, literally, an SD card inside a box. The problem is not unique to Lenovo: ten devices from several manufacturers share the same internal kit and the same issues, as Li's expanded investigation showed.
For IT administrators, the lesson is practical: require that data encryption occurs inside the storage device itself, not on the computer's software. Verify that the encryption key never leaves the drive, that there is independent certification (FIPS 140-2, Common Criteria), and that the protection survives physical removal of the storage component. For individual users, the advice is to treat the biometric reader as a switch, not as encryption: move confidential files to independently encrypted storage and use solutions like BitLocker To Go on Windows or FileVault on macOS to protect data on removable devices.
The question that remains: in a consumer security market increasingly rushed to launch, how many other devices promise encryption that in practice is only a facade?
Sources: Tom's Hardware, Tech Prolonged, Tech Current
✓ Independent sources cross-checked and verified before publishing
