PT-2019-13445 · Hid Global · Hid Global Digitalpersona U.Are.U 4500 Fingerprint Reader

Published 2019-07-15 · Updated 2020-08-24 · CVE-2019-13604

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader version 24

Description The issue concerns a short key used for obfuscating fingerprint images, which is susceptible to brute-force attacks. An attacker can exploit this to recover the key and subsequently decrypt the fingerprint image, leading to a leak of sensitive biometric information.

Recommendations For version 24, update to a newer version that addresses the short key vulnerability to prevent brute-force attacks and potential biometric data leaks.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2019-13604

Affected Products

Hid Global Digitalpersona U.Are.U 4500 Fingerprint Reader

References · 5

• 🔥 https://youtube.com/watch?v=7tKJQdKRm2k · Exploit
• 🔥 https://youtube.com/watch?v=BwYK_xZlKi4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13604 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13604 · Vendor Advisory
• https://github.com/sungjungk/fp-img-key-crack · Note