PT-2023-31546 · Goodix+2 · Goodix Fingerprint Device+2

0X30N + 3 · Published 2023-12-09 · Updated 2023-12-13 · CVE-2023-50430

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Goodix Fingerprint Device (affected versions not specified) Dell Inspiron 15 computers (affected versions not specified)

Description The Goodix Fingerprint Device does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux. It accepts an unauthenticated configuration packet to select the Windows template database, allowing bypass of Windows Hello authentication by enrolling an attacker's fingerprint.

Recommendations For the Goodix Fingerprint Device, consider disabling the enrollment feature via Linux until a patch is available. For Dell Inspiron 15 computers, restrict access to the fingerprint enrollment process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-50430

Affected Products

Dell Inspiron 15

Goodix Fingerprint Device

Windows Shell

References · 6

• 🔥 https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-50430 · Security Note
• https://t.me/cvenotify/63537 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1733631583511310478 · Twitter Post
• https://t.me/cvenotify/63105 · Telegram Post
• https://twitter.com/CVEnew/status/1733610897459777783 · Twitter Post