Code injection

2019-07-1617:15:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.1%

JSON

An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It has a statically coded initialization vector to encrypt a user’s fingerprint image, resulting in weak encryption of that. This, in combination with retrieving an encrypted fingerprint image and encryption key (through another vulnerability), allows an attacker to obtain a user’s fingerprint image.

CPENameOperatorVersion
digital_persona_u.are.u_4500_driver_firmwareeq5.0.0.5

CPE	Name	Operator	Version
	digital_persona_u.are.u_4500_driver_firmware	eq	5.0.0.5

References

github.com/sungjungk/fp-scanner-hacking

www.youtube.com/watch?v=Grirez2xeas

www.youtube.com/watch?v=wEXJDyEOatM