This vulnerability (CVE-2026-75940) concerns the Lenovo Health Android Application, specifically versions from 0 through 1.5.0. It is classified as CWE-798, indicating the use of hard-coded credentials within the application. Such hard-coded credentials can be exploited by attackers to gain unauthorized access to sensitive health-related data. The CVSS 4.0 base score is 9.3, reflecting a critical severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability affects confidentiality and integrity with high impact. The application is distributed exclusively in the Chinese market. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker can exploit the hard-coded credentials to access sensitive health-related information stored or processed by the Lenovo Health Android Application. This unauthorized access compromises the confidentiality and integrity of user health data. The vulnerability requires no privileges or user interaction, making it highly exploitable over the network. The critical CVSS score reflects the severity of potential data exposure and manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about using affected versions of the Lenovo Health Application. Lenovo has not provided a patch or temporary fix at this time.