CVE-2024-0454

Security Vulnerability on Match-on-Chip FPR Architecture

State: Published
Severity: 6.0 Medium
Published: Jan 12, 2024
Updated: Nov 6, 2024
Reserved: Jan 12, 2024

Description

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

Scores

CVSS	Score	Vector	Source
3.1	6.0 Medium	CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L	ELAN

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
DELL InspironELAN	3.0.12011.08001 to before 3.0.12011.08009Affected 3.3.12011.08101 to before 3.3.12011.08103Affected

References

https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.