What’s Vulnerable › Vulnerabilities

CVE-2024-0454: Security Vulnerability on Match-on-Chip FPR Architecture

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-12 · updated 2026-06-17
• Weakness: CWE-290

Description

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

Affected products

• EMC Elan Match-On-Chip Fpr Solution Firmware: 3.0.12011.08009, 3.3.12011.08103

References

• https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy
• https://github.com/advisories/GHSA-w3jx-33qh-77f8
• https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy

Get alerted when CVE-2024-0454 or the next vulnerability affects your stack