Vulnerability · Published Jan 27, 2024 · Assigned by Synaptics
CVE-2023-6482Encryption key derived from static host information
Medium 5.2
In plain English
A medium-severity security flaw in Synaptics Fingerprint Driver from Synaptics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.2Medium
Exploit odds (30 days)0.1%top 97.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the template database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synaptics | Synaptics Fingerprint Driver | 6.0.0.1103 – before 6.0.17.1103 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N