PT-2020-9975 · Synaptics · Synaptics Vfs75Xx

Published 2020-07-22 · Updated 2020-07-30 · CVE-2019-18618

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Synaptics VFS75xx family fingerprint sensors versions prior to 2019-11-15

Description: The issue concerns incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash. This allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.

Recommendations: For Synaptics VFS75xx family fingerprint sensors versions prior to 2019-11-15, ensure that firmware updates are applied to address the incorrect access control issue, as updates after 2019-11-15 should include the necessary fixes. As a temporary workaround, consider restricting physical access to the devices to minimize the risk of exploitation by a physical attacker.

Fix

Related Identifiers

CVE-2019-18618

Affected Products

Synaptics Vfs75Xx

References · 7

• https://support.lenovo.com/us/en/product_security/LEN-31372 · Patch
• https://support.hp.com/us-en/document/c06696474 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-18618 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18618 · Vendor Advisory
• https://synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf · Vendor Advisory
• https://synaptics.com/company/blog · Vendor Advisory
• https://t.me/cibsecurity/13587 · Telegram Post