Lenovo Fingerprint Manager Software on Older Windows Machines Is Vulnerable to Hacks

Lenovo Fingerprint Manager Software on Older Windows Machines Is Vulnerable to Hacks
  • Lenovo acknowledges the existence of the vulnerability
  • The vulnerability exists in the company's Fingerprint Manager Pro
  • Windows 10 devices remain unaffected

A critical vulnerability has emerged on over three dozen Lenovo systems that could let hackers bypass fingerprint scanner and gain access to existing Windows credentials. Machines that are affected by the security loophole includes several ThinkPad, ThinkStation, and ThinkCentre systems. Lenovo has acknowledged the flaw and released an update to its Fingerprint Manager Pro as a part of its mitigation strategy.

The latest vulnerability, which the company marked with high severity, exists in the Lenovo Fingerprint Pro utility that is specifically designed for Lenovo ThinkPad, ThinkStation, and ThinkCentre running Windows 7, Windows 8, and Windows 8.1. The scope of the vulnerability is quite wide as hackers could achieve access to Windows login credentials and fingerprint data. Nevertheless, it remains unaffected on systems with Windows 10 as the new operating system uses Microsoft's built-in fingerprint reader support through Windows Hello.

"Sensitive data stored by Lenovo Fingerprint Manager Pro, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in," Lenovo said in a security advisory.

The list of models that are affected with the flaw includes the Lenovo ThinkPad L560, ThinkPad P40 Yoga, ThinkPad P50s Yoga, ThinkPad T440, ThinkPad T440p, ThinkPad T440s, ThinkPad T450, ThinkPad T450s, ThinkPad T460, ThinkPad T540p, ThinkPad T550, ThinkPad T560, ThinkPad W540, ThinkPad W541, ThinkPad W550s, ThinkPad X1 Carbon (Type 20A7, 20A8), ThinkPad X1 Carbon (Type 20BS, 20BT), ThinkPad X240, ThinkPad X240s, ThinkPad X250, ThinkPad X260, ThinkPad Yoga 14 (20FY), ThinkPad Yoga 460, ThinkCentre M73, ThinkCentreM73z, ThinkCentre M78, ThinkCentre M79, ThinkCentre M83, ThinkCentre M93p, ThinkCentre M93z, ThinkStation E32, ThinkStation P300, ThinkStation P500, ThinkCentre P700, and ThinkCentre P900.

Importantly, the vulnerability can only be exploited with local access. This means that the hacker needs to bypass the weak security layer in person, instead of using any remote access channel.

As of January 25, Lenovo has released Fingerprint Manager Pro version 8.01.87 to mitigate the vulnerability.


For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Jagmeet Singh writes about consumer technology for Gadgets 360, out of New Delhi. Jagmeet is a senior reporter for Gadgets 360, and has frequently written about apps, computer security, Internet services, and telecom developments. Jagmeet is available on Twitter at @JagmeetS13 or Email at jagmeets@ndtv.com. Please send in your leads and tips. More
A Man Accused of Cheating at Video Games May Lose His Decades-Old Guinness World Record
Facebook Details Its Privacy Principles as It Braces for New EU Law
Share on Facebook Tweet Snapchat Share Reddit Comment




© Copyright Red Pixels Ventures Limited 2022. All rights reserved.