CVE-2023-50430

6.4 mediumEPSS 0.4%

Medium (6.4) in goodix fingerprint sensor firmware. EPSS 0.4% chance of exploitation in the next 30 days.

The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint.

Severity

CVSS 3.1

6.4 medium

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2023-12-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

goodix:fingerprint_sensor_firmware

References

https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/
https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/

Check your stack JSON