ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.
This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.
Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
References
| Link | Resource |
|---|---|
| https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy | Not Applicable |
| https://github.com/advisories/GHSA-w3jx-33qh-77f8 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
22 Jan 2024, 16:10
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-290 | |
| First Time |
Emc elan Match-on-chip Fpr Solution
Emc Emc elan Match-on-chip Fpr Solution Firmware |
|
| References |
|
|
| References | () https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy - Not Applicable | |
| CPE | cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:* cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:* cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:* |
12 Jan 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-12 02:15
Updated : 2024-01-22 16:10
NVD link : CVE-2024-0454
Mitre link : CVE-2024-0454
JSON object : View
Products Affected
emc
- elan_match-on-chip_fpr_solution_firmware
- elan_match-on-chip_fpr_solution
CWE
CWE-290
Authentication Bypass by Spoofing