Description
Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
https://www.synaptics.com/company/blog/
Patch, Third Party Advisory x_refsource_misc
https://support.lenovo.com/us/en/product_security/LEN-31372
Vendor Advisory x_refsource_confirm
https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf
Patch, Third Party Advisory x_refsource_misc
https://support.hp.com/us-en/document/c06696474
Scores
CVSS v3
6.0
EPSS
0.0037
EPSS Percentile
59.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Details
Status
published
Products (50)
hp/elite_slice_firmware
< 5.2.3110.26
hp/elite_x2_1012_g2_firmware
< 5.2.5026.26
hp/elite_x2_1013_g3_firmware
< 5.5.21.1099
hp/elite_x2_g4_firmware
< 5.5.21.1099
hp/elitebook_1040_g4_firmware
< 5.2.5026.26
hp/elitebook_1050_g1_firmware
< 5.5.21.1099
hp/elitebook_735_g5_firmware
< 5.5.21.1099
hp/elitebook_735_g6_firmware
< 5.5.21.1099
hp/elitebook_745_g5_firmware
< 5.5.21.1099
hp/elitebook_745_g6_firmware
< 5.5.21.1099
... and 40 more
Published
Jul 22, 2020
Tracked Since
Feb 18, 2026