PT-2024-15573 · Microsoft+1 · Windows Shell+1

Published 2024-01-12 · Updated 2024-01-22 · CVE-2024-0454

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ELAN Match-on-Chip FPR solution versions prior to 3.0.12011.08009 (Legacy) ELAN Match-on-Chip FPR solution versions prior to 3.3.12011.08103 (ESS)

Description The ELAN Match-on-Chip FPR solution has a design fault that poses a potential risk of valid SID leakage and enumeration with a spoof sensor. This fault can lead to the bypass of Windows Hello recognition by cloning the SID, resulting in broken account identity.

Recommendations For versions lower than 3.0.12011.08009 (Legacy), update to version 3.0.12011.08009 or later to resolve the issue. For versions lower than 3.3.12011.08103 (ESS), update to version 3.3.12011.08103 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Windows Hello recognition feature until a patch is available.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-0454

GHSA-W3JX-33QH-77F8

Affected Products

Elan Match-On-Chip Fpr Solution

Windows Shell

References · 6

• https://osv.dev/vulnerability/CVE-2024-0454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0454 · Security Note
• https://t.me/cvenotify/67155 · Telegram Post
• https://emc.com.tw/emc/tw/vulnerability-disclosure-policy · Note
• https://t.me/cvenotify/68222 · Telegram Post
• https://github.com/advisories/GHSA-w3jx-33qh-77f8 · Note