Lenovo Fingerprint Manager Software on Older Windows Machines Is Vulnerable to Hacks

A critical vulnerability has emerged on over three dozen Lenovo systems that could let hackers bypass fingerprint scanner and gain access to existing Windows credentials. Machines that are affected by the security loophole includes several ThinkPad, ThinkStation, and ThinkCentre systems. Lenovo has acknowledged the flaw and released an update to its Fingerprint Manager Pro as a part of its mitigation strategy.

The latest vulnerability, which the company marked with high severity, exists in the Lenovo Fingerprint Pro utility that is specifically designed for Lenovo ThinkPad, ThinkStation, and ThinkCentre running Windows 7, Windows 8, and Windows 8.1. The scope of the vulnerability is quite wide as hackers could achieve access to Windows login credentials and fingerprint data. Nevertheless, it remains unaffected on systems with Windows 10 as the new operating system uses Microsoft's built-in fingerprint reader support through Windows Hello.

"Sensitive data stored by Lenovo Fingerprint Manager Pro, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in," Lenovo said in a security advisory.

The list of models that are affected with the flaw includes the Lenovo ThinkPad L560, ThinkPad P40 Yoga, ThinkPad P50s Yoga, ThinkPad T440, ThinkPad T440p, ThinkPad T440s, ThinkPad T450, ThinkPad T450s, ThinkPad T460, ThinkPad T540p, ThinkPad T550, ThinkPad T560, ThinkPad W540, ThinkPad W541, ThinkPad W550s, ThinkPad X1 Carbon (Type 20A7, 20A8), ThinkPad X1 Carbon (Type 20BS, 20BT), ThinkPad X240, ThinkPad X240s, ThinkPad X250, ThinkPad X260, ThinkPad Yoga 14 (20FY), ThinkPad Yoga 460, ThinkCentre M73, ThinkCentreM73z, ThinkCentre M78, ThinkCentre M79, ThinkCentre M83, ThinkCentre M93p, ThinkCentre M93z, ThinkStation E32, ThinkStation P300, ThinkStation P500, ThinkCentre P700, and ThinkCentre P900.

Importantly, the vulnerability can only be exploited with local access. This means that the hacker needs to bypass the weak security layer in person, instead of using any remote access channel.

As of January 25, Lenovo has released Fingerprint Manager Pro version 8.01.87 to mitigate the vulnerability.