CVE-2019-13604
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HID Global DigitalPersona U.are.U 4500 Fingerprint Reader是美国HID Global公司的一款指纹识别器。 HID Global DigitalPersona U.are.U 4500 Fingerprint Reader v24版本中存在安全漏洞。攻击者可利用该漏洞恢复密钥并解密使用密钥加密的图像，泄露敏感信息。
Possible ATT&CK Techniques 1 AI
T1143
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-13604
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
HID Global DigitalPersona U.are.U 4500 Fingerprint Reader 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HID Global DigitalPersona U.are.U 4500 Fingerprint Reader是美国HID Global公司的一款指纹识别器。 HID Global DigitalPersona U.are.U 4500 Fingerprint Reader v24版本中存在安全漏洞。攻击者可利用该漏洞恢复密钥并解密使用密钥加密的图像，泄露敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2019-13604
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-13604
请登录查看更多情报信息。
Other References for CVE-2019-13604 (3)
-
https://www.youtube.com/watch?v=BwYK_xZlKi4 x_refsource_MISC
-
https://github.com/sungjungk/fp-img-key-crack x_refsource_MISC
-
https://www.youtube.com/watch?v=7tKJQdKRm2k x_refsource_MISC
Same Patch Batch · n/a · 2019-07-15 · 5 CVEs total
| CVE-2014-10374 | Fitbit activity-tracker 信息泄露漏洞 | |
| CVE-2019-5447 | http-file-server 路径遍历漏洞 | |
| CVE-2019-6827 | Schneider Electric Interactive Graphical SCADA System 缓冲区错误漏洞 | |
| CVE-2019-13611 | python-engineio 跨站请求伪造漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2019-13604
No comments yet