PC maker Lenovo issued a fix for a hardcoded password flaw impacting ThinkPad, ThinkCentre and ThinkStation laptops. The flaw affects nearly a dozen Lenovo laptop models that run versions of Microsoft Windows 7, 8 and the 8.1 operating system.

The vulnerability was disclosed by Lenovo on Thursday who also offered a patch to fix affected systems.

“Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed,” according to Mitre’s Common Vulnerabilities and Exposures description of the vulnerability (CVE-2017-3762).

Lenovo credited Jackson Thuraisamy, a senior security consultant with Security Compass, for finding and disclosing the flaw.

Mitigation includes updating Lenovo’s Fingerprint Manager Pro to version 8.01.87 or later. Lenovo laptops running Windows 10 are not impacted by the flaw because that version of Microsoft’s operating system natively supports fingerprint reader technology.

Lenovo is urging users of the following laptops to update their Lenovo Fingerprint Manager Pro version to 8.01.87 or higher.

ThinkPad L560
ThinkPad P40 Yoga, P50s
ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
ThinkPad W540, W541, W550s
ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
ThinkPad X240, X240s, X250, X260
ThinkPad Yoga 14 (20FY), Yoga 460
ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
ThinkStation E32, P300, P500, P700, P900

 

Source: threatpost.com