Privilege Escalation and Arbitrary Code Execution Vulnerability in HP UEFI Firmware
CVE-2021-39301

8.8HIGH

Key Information:

Vendor

HP
Status
Business Notebook Pcs BiOS; Business Desktop Pcs BiOS; Retail Point-of-sale Systems BiOS; Workstations BiOS
Vendor
CVE Published:
16 February 2022

What is CVE-2021-39301?

Potential vulnerabilities have been identified in the UEFI firmware (BIOS) for various HP PC products. These vulnerabilities could allow unauthorized escalation of privileges and enable arbitrary code execution, posing significant security risks to affected systems. Users are urged to apply the latest firmware updates to mitigate these risks effectively.

Affected Version(s)

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.12.00

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.08.00

BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS before 01.19.00

References

https://support.hp.com/us-en/document/ish_5661066-5661090-16
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.