{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-6482 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2023-6482 yet. Limit exposure of the affected software until one is available.","what":"CVE-2023-6482 is a medium-severity vulnerability in Synaptics Fingerprint Driver, published on 27 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-6482 and fix it if it is affected.\n\nWhat it is: CVE-2023-6482 is a medium-severity vulnerability in Synaptics Fingerprint Driver, published on 27 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-6482 in the wild and no public exploit code.\n\nAffected product: Synaptics Fingerprint Driver. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-6482/ (Markdown: https://insights.sbomify.com/CVE-2023-6482/index.md)","id":"CVE-2023-6482","markdown":"https://insights.sbomify.com/CVE-2023-6482/index.md","name":"CVE-2023-6482","record":{"aliases":["GHSA-g5jr-34r4-rv4w"],"analysis":{"component_type":"hardware_firmware","fix_type":"patch","impacts":["privilege_escalation","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Synaptics Fingerprint Driver","requires_auth":"none","summary":"An attacker with physical access can enroll unauthorized fingerprints by exploiting a static encryption key in the Synaptics Fingerprint Driver.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Synaptics","cpe":[{"product":"fingerprint_driver","vendor":"synaptics"}],"cvss":{"score":5.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"},{"id":"CWE-321","name":"Use of Hard-coded Cryptographic Key"}],"description":"Use of encryption key derived from static information in Synaptics Fingerprint Driver allows \n\nan attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may \nallow an attacker, who has physical access to the sensor, to enroll a fingerprint into the \ntemplate database.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Encryption key derived from static host information","id":"CVE-2023-6482","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"hardcoded_credentials","year":"2023"},"n_packages":0,"n_references":1,"next":{"headline":"Improper Authentication Vulnerability in ADiTaaS","id":"CVE-2023-6483"},"packages":[],"prev":{"headline":"Logback \"receiver\" DOS vulnerability CVE-2023-6378 incomplete fix","id":"CVE-2023-6481"},"products":["Synaptics Fingerprint Driver"],"published":"2024-01-27","related":[{"cvss_score":5.5,"headline":"synaTEE.signed.dll Out-Of-Bounds Heap Write","id":"CVE-2021-3675","kev_date_added":null,"published":"2022-06-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-18","vendors":["Synaptics"]},"summary":"An attacker with physical access can enroll unauthorized fingerprints by exploiting a static encryption key in the Synaptics Fingerprint Driver.","url":"https://insights.sbomify.com/CVE-2023-6482/"}