CVE-2019-18618

Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table.

• https://support.hp.com/us-en/document/c06696474Patch, Third Party Advisory
• https://support.lenovo.com/us/en/product_security/LEN-31372Patch, Third Party Advisory
• https://www.synaptics.com/company/blog/Vendor Advisory
• https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdfVendor Advisory
• https://support.hp.com/us-en/document/c06696474Patch, Third Party Advisory
• https://support.lenovo.com/us/en/product_security/LEN-31372Patch, Third Party Advisory
• https://www.synaptics.com/company/blog/Vendor Advisory
• https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdfVendor Advisory

Published

Jul 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1861A vulnerability in the software update feature of Cisco Indu…7.2
• CVE-2019-18610An issue was discovered in manager.c in Sangoma Asterisk thr…8.8
• CVE-2019-18611An issue was discovered in the CheckUser extension through 1…6.5
• CVE-2019-18612An issue was discovered in the AbuseFilter extension through…5.3
• CVE-2019-18614On the Cypress CYW20735 evaluation board, any data that exce…7.8
• CVE-2019-18615In CloudVision Portal (CVP) for all releases in the 2018.2 T…4.9
• CVE-2019-18619Incorrect parameter validation in the synaTee component of S…7.8
• CVE-2019-1862A vulnerability in the web-based user interface (Web UI) of …7.2
• CVE-2019-18622An issue was discovered in phpMyAdmin before 4.9.2. A crafte…9.8
• CVE-2019-18623Escalation of privileges in EnergyCAP 7 through 7.5.6 allows…9.8
• CVE-2019-18624Opera Mini for Android allows attackers to bypass intended r…9.8
• CVE-2019-18625An issue was discovered in Suricata 5.0.0. It was possible t…7.5