PT-2023-31546 · Goodix+2 · Goodix Fingerprint Device+2

0X30N + 3 · Publicado 2023-12-09 · Atualizado 2023-12-13 · CVE-2023-50430

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Goodix Fingerprint Device (affected versions not specified) Dell Inspiron 15 computers (affected versions not specified)

Description The Goodix Fingerprint Device does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux. It accepts an unauthenticated configuration packet to select the Windows template database, allowing bypass of Windows Hello authentication by enrolling an attacker's fingerprint.

Recommendations For the Goodix Fingerprint Device, consider disabling the enrollment feature via Linux until a patch is available. For Dell Inspiron 15 computers, restrict access to the fingerprint enrollment process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-50430

Produtos afetados

Dell Inspiron 15

Goodix Fingerprint Device

Windows Shell

Referências · 6

• 🔥 https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i · Exploit
• https://t.me/cvenotify/63537 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-50430 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1733631583511310478 · Publicação no Twitter
• https://t.me/cvenotify/63105 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1733610897459777783 · Publicação no Twitter