Monday, May 5, 2025
HomeCVE/vulnerabilityAttackers Can Bypass Lenovo Fingerprint Manager through a Hard-coded Password

Attackers Can Bypass Lenovo Fingerprint Manager through a Hard-coded Password

Published on

SIEM as a Service

Follow Us on Google News

Lenovo released a security update for critical vulnerability with Lenovo Fingerprint Manager Pro that impacts dozens of ThinkPad, ThinkCentre and ThinkStation Workstations that are running Windows 7, 8 and the 8.1 operating systems.

It is a utility for user authentication based on fingerprint recognition for Windows 8.1 (32-bit, 64-bit), 8 (32-bit, 64-bit), 7 (32-bit, 64-bit) – ThinkPad, ThinkCentre, Workstations.

A critical Local Privilege Escalation vulnerability detected with Lenovo Fingerprint Manager Pro allows a local attacker to get access to the system and even to Windows login credentials and fingerprint data.

A vulnerability has been identified in Lenovo Fingerprint Manager Pro. Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows login credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in.
- Advertisement - Google News

Lenovo credited Jackson Thuraisamy from Security Compass for identifying this issue(CVE-2017-3762).

Impacted Workstations

  • ThinkPad L560.
  • ThinkPad P40 Yoga, P50s.
  • ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560.
  • ThinkPad W540, W541, W550s.
  • ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT).
  • ThinkPad X240, X240s, X250, X260.
  • ThinkPad Yoga 14 (20FY), Yoga 460.
  • ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z.
  • ThinkStation E32, P300, P500, P700, P900.

Mitigations – Lenovo Fingerprint Manager Pro

Lenovo strongly recommends to Update Fingerprint Manager Pro to version 8.01.87 or later.

A couple of days Lenovo discovered a backdoor in network switches that powered by Enterprise Network Operating System firmware during the security audit by Lenovo in the Telnet and Serial Console management interfaces.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

MediaTek Fixes Multiple Security Flaws in Smartphone, Tablet, and TV Chipsets

MediaTek, a leading provider of chipset technology for smartphones, tablets, AIoT, and smart TVs,...

Multiple Flaws in Tenda RX2 Pro Let Attackers Gain Admin Access

Security researchers have uncovered a series of critical vulnerabilities in the Tenda RX2 Pro...

Apache Parquet Java Vulnerability Enables Remote Code Execution

A high-severity vulnerability (CVE-2025-46762) has been discovered in Apache Parquet Java, exposing systems using...