What’s Vulnerable › Vulnerabilities

CVE-2019-18618

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-22 · updated 2026-06-17

Description

Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.

Affected products

• HP Elite Slice Firmware: before 5.2.3110.26 — fixed in 5.2.3110.26
• HP Elite X2 1012 G2 Firmware: before 5.2.5026.26 — fixed in 5.2.5026.26
• HP Elite X2 1013 G3 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elite X2 G4 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 1040 G4 Firmware: before 5.2.5026.26 — fixed in 5.2.5026.26
• HP Elitebook 1050 G1 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 735 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 735 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 745 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 745 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 755 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 830 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 830 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 836 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 836 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 840 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 840 G5 Healthcare Edition Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 840 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 840 G6 Healthcare Edition Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 846 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 846 G5 Healthcare Edition Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 846 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 846 G6 Healthcare Edition Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 850 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook 850 G6 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook X360 1020 G2 Firmware: before 5.2.5026.26 — fixed in 5.2.5026.26
• HP Elitebook X360 1030 G2 Firmware: before 5.2.5026.26 — fixed in 5.2.5026.26
• HP Elitebook X360 1030 G3 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook X360 1030 G4 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099
• HP Elitebook X360 1040 G5 Firmware: before 5.5.21.1099 — fixed in 5.5.21.1099

How to fix

Upgrade to a fixed version: HP Elite Slice Firmware 5.2.3110.26; HP Elite X2 1012 G2 Firmware 5.2.5026.26; HP Elite X2 1013 G3 Firmware 5.5.21.1099; HP Elite X2 G4 Firmware 5.5.21.1099; HP Elitebook 1040 G4 Firmware 5.2.5026.26; HP Elitebook 1050 G1 Firmware 5.5.21.1099; HP Elitebook 735 G5 Firmware 5.5.21.1099; HP Elitebook 735 G6 Firmware 5.5.21.1099; HP Elitebook 745 G5 Firmware 5.5.21.1099; HP Elitebook 745 G6 Firmware 5.5.21.1099; HP Elitebook 755 G5 Firmware 5.5.21.1099; HP Elitebook 830 G5 Firmware 5.5.21.1099. Check the vendor advisory for mitigations.

References

• https://support.hp.com/us-en/document/c06696474
• https://support.lenovo.com/us/en/product_security/LEN-31372
• https://www.synaptics.com/company/blog/
• https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf
• https://support.hp.com/us-en/document/c06696474
• https://support.lenovo.com/us/en/product_security/LEN-31372
• https://www.synaptics.com/company/blog/
• https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf

Get alerted when CVE-2019-18618 or the next vulnerability affects your stack