What is CVE-2023-50430?

CVE-2023-50430 is a medium-severity vulnerability in Goodix Fingerprint Sensor, classified under Improper Authentication. CVSS score: 6.4/10. Published 2023-12-09.

How severe is CVE-2023-50430?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Is CVE-2023-50430 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Goodix Fingerprint Sensor

CVE-2023-50430

The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint.

Vulnerability class: Broken Authentication

EPSS: 0.004 (33.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@mitre.org (Technical Description, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-50430?: CVE-2023-50430 is a medium-severity vulnerability in Goodix Fingerprint Sensor, classified under Improper Authentication. CVSS score: 6.4/10. Published 2023-12-09.
How severe is CVE-2023-50430?: Medium severity. CVSS v3 base score is 6.4 out of 10.
Is CVE-2023-50430 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.