CVE-2024-0454 — MEDIUM (6.0)

Vulnerability Description

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

CVSS Score

6.0

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Emc	Elan Match-On-Chip Fpr Solution Firmware	3.0.12011.08009
Emc	Elan Match-On-Chip Fpr Solution	-

Related Weaknesses (CWE)

CWE-290

References

https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable
https://github.com/advisories/GHSA-w3jx-33qh-77f8Third Party Advisory
https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policyNot Applicable

FAQ

What is CVE-2024-0454?

CVE-2024-0454 is a vulnerability with a CVSS score of 6.0 (MEDIUM). ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cl...

How severe is CVE-2024-0454?

CVE-2024-0454 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-0454?

Check the references section above for vendor advisories and patch information. Affected products include: Emc Elan Match-On-Chip Fpr Solution Firmware, Emc Elan Match-On-Chip Fpr Solution.