UEFI Firmware Vulnerability in HP PC Products
CVE-2021-39297

8.8HIGH

Key Information:

Vendor

HP
Status
Business Notebook Pcs BiOS; Business Desktop Pcs BiOS; Retail Point-of-sale Systems BiOS; Workstations BiOS
Vendor
CVE Published:
16 February 2022

What is CVE-2021-39297?

Potential vulnerabilities have been discovered in the UEFI firmware of various HP PC products. These vulnerabilities may enable an attacker to gain elevated privileges on affected systems, potentially leading to arbitrary code execution. Users of HP computers should review the details and apply necessary patches to mitigate any security risks associated with this vulnerability.

Affected Version(s)

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.12.00

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.08.00

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.19.00

References

https://support.hp.com/us-en/document/ish_5661066-5661090-16
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.