PT-2019-13445 · Hid Global · Hid Global Digitalpersona U.Are.U 4500 Fingerprint Reader

Publicado 2019-07-15 · Atualizado 2020-08-24 · CVE-2019-13604

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader version 24

Description The issue concerns a short key used for obfuscating fingerprint images, which is susceptible to brute-force attacks. An attacker can exploit this to recover the key and subsequently decrypt the fingerprint image, leading to a leak of sensitive biometric information.

Recommendations For version 24, update to a newer version that addresses the short key vulnerability to prevent brute-force attacks and potential biometric data leaks.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2019-13604

Produtos afetados

Hid Global Digitalpersona U.Are.U 4500 Fingerprint Reader

Referências · 5

• 🔥 https://youtube.com/watch?v=7tKJQdKRm2k · Exploit
• 🔥 https://youtube.com/watch?v=BwYK_xZlKi4 · Exploit
• https://github.com/sungjungk/fp-img-key-crack · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13604 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13604 · Aviso do Fabricante