CVE-2023-6482

mediumpriority · track · 21OT risk · elevatedEPSS 0.001 · 3 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.13% (3rd) EPSS

CVSS 5.2 · medium

Is it mine?

2 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the template database.

cvss

Technical severity, 0–10. One row per scoring source.

5.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.2mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nprimary · NVD / NIST USexploitability 0.9 · impact 4.2

v3.15.2mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nsecondary · ENISA EU

v3.15.2mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nsecondary · PSIRT@synaptics.comexploitability 0.9 · impact 4.2

v3.14.8mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-798USprimaryCWE-321US

affected products (2)

Products and version ranges known to be affected.

Synaptics Synaptics Fingerprint Driver6.0.0.1103 → 6.0.17.1103enisa_euvdEU
synaptics fingerprint driver6.0.00.1103 → 6.0.17.1103nvdUScpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2024-01-27modified 2026-06-17

related (2,281)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-22769US	critical10.0OT critical	13.5% (96th)	KEV	2026-02-17
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attack…
CVE-2025-14611US	critical9.8OT critical	53.3% (99th)	KEV	2025-12-12
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose…
CVE-2025-30406US	critical9.8OT critical	94.3% (100th)	KEV	2025-04-03
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited…
CVE-2024-20439US	critical9.8OT critical	97.1% (100th)	KEV	2024-09-04
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.…
CVE-2024-28987US	critical9.1OT critical	93.3% (100th)	KEV	2024-08-21
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify da…

+2276 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan