CVEvulnerability
CVE-2016-3917
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-10-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka internal bug 30744668.
Affected configurations
• google android 6.0.1
• google android 7.0
Related
Weakness · not in database (1)
References
- http://source.android.com/security/bulletin/2016-10-01.html Vendor Advisory
- http://www.securityfocus.com/bid/93298 www.securityfocus.com
- https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd Issue Tracking, Patch
- http://source.android.com/security/bulletin/2016-10-01.html Vendor Advisory
- http://www.securityfocus.com/bid/93298 www.securityfocus.com
- https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd Issue Tracking, Patch