CVE-2024-0454

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0454", "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df", "state": "PUBLISHED", "assignerShortName": "ELAN", "dateReserved": "2024-01-12T01:47:40.093Z", "datePublished": "2024-01-12T01:48:47.887Z", "dateUpdated": "2024-11-06T17:10:10.844Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Windows Hello Identification"], "packageName": "UMDF Driver", "platforms": ["Windows"], "product": "DELL Inspiron", "vendor": "ELAN", "versions": [{"lessThan": "3.0.12011.08009", "status": "affected", "version": "3.0.12011.08001", "versionType": "custom"}, {"lessThan": "3.3.12011.08103", "status": "affected", "version": "3.3.12011.08101", "versionType": "custom"}]}], "datePublic": "2024-01-12T01:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.<br>This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.<br>Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."}], "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "36106deb-8e95-420b-a0a0-e70af5d245df", "shortName": "ELAN", "dateUpdated": "2024-01-12T01:48:47.887Z"}, "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"}], "source": {"discovery": "EXTERNAL"}, "title": "Security Vulnerability on Match-on-Chip FPR Architecture", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:04:49.725Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "elan", "product": "dell_inspiron", "cpes": ["cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.12011.08001", "status": "affected", "lessThan": "3.0.12011.08009", "versionType": "custom"}, {"version": "3.3.12011.08101", "status": "affected", "lessThan": "3.3.12011.08103", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-06T17:07:08.650230Z", "id": "CVE-2024-0454", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T17:10:10.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:04:49.725Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-06T17:07:08.650230Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"], "vendor": "elan", "product": "dell_inspiron", "versions": [{"status": "affected", "version": "3.0.12011.08001", "lessThan": "3.0.12011.08009", "versionType": "custom"}, {"status": "affected", "version": "3.3.12011.08101", "lessThan": "3.3.12011.08103", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T17:10:01.403Z"}}], "cna": {"title": "Security Vulnerability on Match-on-Chip FPR Architecture", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ELAN", "modules": ["Windows Hello Identification"], "product": "DELL Inspiron", "versions": [{"status": "affected", "version": "3.0.12011.08001", "lessThan": "3.0.12011.08009", "versionType": "custom"}, {"status": "affected", "version": "3.3.12011.08101", "lessThan": "3.3.12011.08103", "versionType": "custom"}], "platforms": ["Windows"], "packageName": "UMDF Driver", "defaultStatus": "affected"}], "datePublic": "2024-01-12T01:30:00.000Z", "references": [{"url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.", "supportingMedia": [{"type": "text/html", "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.<br>This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.<br>Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "36106deb-8e95-420b-a0a0-e70af5d245df", "shortName": "ELAN", "dateUpdated": "2024-01-12T01:48:47.887Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0454", "state": "PUBLISHED", "dateUpdated": "2024-11-06T17:10:10.844Z", "dateReserved": "2024-01-12T01:47:40.093Z", "assignerOrgId": "36106deb-8e95-420b-a0a0-e70af5d245df", "datePublished": "2024-01-12T01:48:47.887Z", "assignerShortName": "ELAN"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["Windows Hello Identification"], "packageName": "UMDF Driver", "platforms": ["Windows"], "product": "DELL Inspiron", "vendor": "ELAN", "versions": [{"lessThan": "3.0.12011.08009", "status": "affected", "version": "3.0.12011.08001", "versionType": "custom"}, {"lessThan": "3.3.12011.08103", "status": "affected", "version": "3.3.12011.08101", "versionType": "custom"}]}], "source": "36106deb-8e95-420b-a0a0-e70af5d245df"}, {"affectedData": [{"cpes": ["cpe:2.3:a:elan:dell_inspiron:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "dell_inspiron", "vendor": "elan", "versions": [{"lessThan": "3.0.12011.08009", "status": "affected", "version": "3.0.12011.08001", "versionType": "custom"}, {"lessThan": "3.3.12011.08103", "status": "affected", "version": "3.3.12011.08101", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.0.12011.08009:*:*:*:*:*:*:*", "matchCriteriaId": "6D3B550F-D100-4116-AE9F-7F9F203F7B0F", "vulnerable": true}, {"criteria": "cpe:2.3:o:emc:elan_match-on-chip_fpr_solution_firmware:3.3.12011.08103:*:*:*:*:*:*:*", "matchCriteriaId": "8BD8D8C7-1B4D-4452-8BC2-6D2B05939AC1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:emc:elan_match-on-chip_fpr_solution:-:*:*:*:*:*:*:*", "matchCriteriaId": "02144756-1716-40FF-884B-3E4DD9D2C0A3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.\nThis fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.\nVersion which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform."}, {"lang": "es", "value": "La soluci\u00f3n ELAN Match-on-Chip FPR tiene un error de dise\u00f1o sobre el riesgo potencial de fuga de SID v\u00e1lido y enumeraci\u00f3n con sensor falso. Este fallo hace que el reconocimiento de Windows Hello se omita al clonar el SID para causar una p\u00e9rdida de identidad de la cuenta. La versi\u00f3n inferior a 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) sufrir\u00eda este riesgo en la plataforma DELL Inspiron."}], "id": "CVE-2024-0454", "lastModified": "2026-06-17T06:53:32.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.5, "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-0454", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-06T17:07:08.650230Z", "version": "2.0.3"}}]}, "published": "2024-01-12T02:15:44.867", "references": [{"source": "36106deb-8e95-420b-a0a0-e70af5d245df", "tags": ["Not Applicable"], "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"}, {"source": "nvd@nist.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-w3jx-33qh-77f8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy"}], "sourceIdentifier": "36106deb-8e95-420b-a0a0-e70af5d245df", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "36106deb-8e95-420b-a0a0-e70af5d245df", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}