Lenovo has confirmed that Fingerprint Manager Pro (8.01.86 version), which allows users to unlock their devices using fingerprint recognition, is affected by a serious vulnerability.
Attackers could exploit the security gap to access any system that is equipped with the application.
According to Lenovo's disclosure, Fingerprint Manager contained a hardcoded code that could connect users locally to non-administrator accounts.
In addition to the hardcoded code, the "security" application stored sensitive information such as Windows login credentials and fingerprints that it "encrypted using a weak algorithm".
Vulnerability was discovered by security compass researcher Jackson Thuraisamy.
https://www.youtube.com/watch?v=JRA34PzvANg
Defective software is available for Windows 7, 8, and 8.1. According to the details published on the company's website, below are all devices that use Fingerprint Manager:
- ThinkPad L560
- ThinkPad P40 Yoga, P50s
- ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
- ThinkPad W540, W541, W550s
- ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
- ThinkPad X240, X240s, X250, X260
- ThinkPad Yoga 14 (20FY), Yoga 460
- ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
- ThinkStation E32, P300, P500, P700, P900
Those of you who have any of the above devices, and the version of Fingerprint Manager Pro is 8.01.86 are advised to update immediately to version 8.01.87 or a newer version. You can do it from the following link:
https://pcsupport.lenovο.com/downloads/ds034486
Information, header image: TNW
