CVE-2019-13604: Medium severity crossmatch digital persona u.are.u 4500 vulnerability

Published Jul 15, 2019

Updated

There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak.

Affected Software

2 affected components

Assaabloy Hid Digitalpersona 4500 Firmware=24

Assaabloy Hid Digitalpersona 4500

Event History

Jul 15, 2019

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

Description

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2019-13604.

What is the affected software?

The affected software is HID Global DigitalPersona U.are.U 4500 Fingerprint Reader v24.

What is the severity of CVE-2019-13604?

The severity of CVE-2019-13604 is medium with a CVSS score of 5.9.

How does this vulnerability allow an attacker to decrypt the fingerprint image?

This vulnerability allows an attacker to recover the key used to obfuscate the fingerprint image, and then decrypt the image using the key.

Are there any known fixes or patches for this vulnerability?

At the moment, there are no known fixes or patches for this vulnerability. It is recommended to stay updated with the latest information from HID Global and apply any security advisories or patches as they become available.