CVE-2023-50430

Published: Dec 9, 2023Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: NVD

Description

The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint.

Affected (1)

Products: Goodix: Fingerprint Sensor Firmware

1 product

Fingerprint Sensor Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Goodix Fingerprint Sensor Firmware	All versions

Running on/with	Platform Versions
Goodix Fingerprint Sensor	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionThird Party Advisory

Timeline

No history available yet.