An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to replay fingerprints and bypass Windows Hello authentication.
An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to replay fingerprints and bypass Windows Hello authentication.
Description: CWE-358 Improperly Implemented Security Check for Standard
Metrics
Version
Base score
Base severity
Vector
3.1
6.3
MEDIUM
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Version:3.1
Base score:6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Enable Windows Hello Enhanced Sign-in Security (ESS) and upgrade to the driver version (or newer) indicated for your model in the advisory: https://support.lenovo.com/us/en/product_security/LEN-155804
An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to replay fingerprints and bypass Windows Hello authentication.