CVE search · CVE-2024-0454
CVE-2024-0454
medium 6.1
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
Details
- Status
- Modified
- Published
- Last changed
- Source
- 36106deb-8e95-420b-a0a0-e70af5d245df
- Weakness
- CWE-290
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 6.0 | CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
36106deb-8e95-420b-a0a0-e70af5d245dfSecondary |
| CVSS 3.1 | medium 6.1 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- emc · elan_match-on-chip_fpr_solution_firmware
References
- https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable
- https://github.com/advisories/GHSA-w3jx-33qh-77f8Third Party Advisory
- https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable