medium6.0
CVE-2019-18618
Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows …
Impact
Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Synaptics | Vfs75xx Firmware | Versions 5.1.5.51, 5.1.337.26, 5.1.3507.26, 5.2.320.26, 5.2.524.26, 5.2.3109.26 |
| Lenovo | Thinkpad 25 Firmware | before 5.2.3540.26 |
| Lenovo | Thankpad A475 Firmware | before 5.02.3539.0026 |
| Lenovo | Thankpad A485 Firmware | before 5.03.3542.0026 |
| Lenovo | Thinkpad E480 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E580 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E485 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E585 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E490s Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad S3 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E490 Firmware | before 5.2.321.26 |
| Lenovo | Thinkpad E590 Firmware | before 5.2.321.26 |
References
- NVD record
- CVE.org record
- https://support.hp.com/us-en/document/c06696474
- https://support.lenovo.com/us/en/product_security/LEN-31372
- https://www.synaptics.com/company/blog/
- https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf
- https://support.hp.com/us-en/document/c06696474
- https://support.lenovo.com/us/en/product_security/LEN-31372
- https://www.synaptics.com/company/blog/
- https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf