What is the CVSS score of CVE-2024-0454?

CVE-2024-0454 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Elan Match On Chip Fpr Solution Firmware are affected by CVE-2024-0454?

Organizations using ELAN Match-on-Chip FPR solution should be aware of moderate risk from CVE-2024-0454 rated CVSS 6.0. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2024-0454?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Elan Match On Chip Fpr Solution Firmware CVE-2024-0454

MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2024-01-12 36106deb-8e95-420b-a0a0-e70af5d245df

Authentication Bypass Dell Microsoft Elan Match On Chip Fpr Solution Firmware Windows

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

CVE Published

Jan 12, 2024 - 02:15 nvd

MEDIUM 6.0

DescriptionCVE.org

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.

AnalysisAI

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-290. ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform. Affected products include: Emc Elan Match-On-Chip Fpr Solution Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.