CVE-2024-0454CWE-290

Security Vulnerability on Match-on-Chip FPR Architecture

Medium · published January 12, 2024

CVSS v3.1
6.0
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.

This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.

Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2024-01-12T01:48Z
EPSS history
Timeline
  • 12 JAN 01:48Z
    Security Vulnerability on Match-on-Chip FPR Architecture
    cvelistv5