CVE-2024-0454 json
Security Vulnerability on Match-on-Chip FPR Architecture
published 2024-01-12 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-16249
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
Patch / fix
- ELAN DELL Inspiron 3.0.12011.08009, 3.3.12011.08103
- elan dell_inspiron 3.0.12011.08009, 3.3.12011.08103
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- ELAN DELL Inspiron
- elan dell_inspiron
Classification
- Weakness
-
- CWE-290 Authentication Bypass by Spoofing
References
-
emc.com.tw
/emc/tw/vulnerability-disclosure-policy
not-applicable
-
github.com
/advisories/GHSA-w3jx-33qh-77f8
third-party-advisory
Sources
- CVE List CVE-2024-0454
- NVD CVE-2024-0454
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.