{"id":"CVE-2024-0454","state":"PUBLISHED","title":"Security Vulnerability on Match-on-Chip FPR Architecture","description":"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.","publishedAt":"2024-01-12T01:48:47.887Z","updatedAt":"2024-11-06T17:10:10.844Z","severity":{"score":6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L","source":"ELAN"},"assigner":"ELAN","products":["ELAN DELL Inspiron"],"affected":[{"vendor":"ELAN","product":"DELL Inspiron","packageName":"UMDF Driver","defaultStatus":"affected","versions":[{"version":"3.0.12011.08001","status":"affected","lessThan":"3.0.12011.08009","versionType":"custom"},{"version":"3.3.12011.08101","status":"affected","lessThan":"3.3.12011.08103","versionType":"custom"}],"modules":["Windows Hello Identification"],"platforms":["Windows"]}],"references":["https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"],"weaknesses":["CWE-290"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0454.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-0454","state":"PUBLISHED","datePublished":"2024-01-12T01:48:47.887Z","dateUpdated":"2024-11-06T17:10:10.844Z","assignerShortName":"ELAN","assignerOrgId":"36106deb-8e95-420b-a0a0-e70af5d245df","dateReserved":"2024-01-12T01:47:40.093Z"},"containers":{"cna":{"title":"Security Vulnerability on Match-on-Chip FPR Architecture","descriptions":[{"lang":"en","value":"ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."}],"affected":[{"vendor":"ELAN","product":"DELL Inspiron","packageName":"UMDF Driver","defaultStatus":"affected","versions":[{"version":"3.0.12011.08001","status":"affected","lessThan":"3.0.12011.08009","versionType":"custom"},{"version":"3.3.12011.08101","status":"affected","lessThan":"3.3.12011.08103","versionType":"custom"}],"modules":["Windows Hello Identification"],"platforms":["Windows"]}],"references":[{"url":"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"LOW","baseScore":6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"CWE-290 Authentication Bypass by Spoofing","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ELAN","orgId":"36106deb-8e95-420b-a0a0-e70af5d245df","dateUpdated":"2024-01-12T01:48:47.887Z"},"datePublic":"2024-01-12T01:30:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:04:49.725Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"elan","product":"dell_inspiron","defaultStatus":"unknown","versions":[{"version":"3.0.12011.08001","status":"affected","lessThan":"3.0.12011.08009","versionType":"custom"},{"version":"3.3.12011.08101","status":"affected","lessThan":"3.3.12011.08103","versionType":"custom"}],"cpes":["cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-06T17:07:08.650230Z","id":"CVE-2024-0454","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-06T17:10:10.844Z"}}]}}}