High severity · published Jun 14, 2023
CVE-2022-31645
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
HP PC BIOS · HP Inc.
See HP Security Bulletin reference for affected versions. · source: vendor
DF
Dragonfly Folio G3 2-in-1 Firmware · HP
01.01.03 · source: NVD
ED
Elite Dragonfly Firmware · HP
01.21.01 · source: NVD
ED
Elite Dragonfly G2 Firmware · HP
01.10.00 · source: NVD
ED
Elite Dragonfly G3 Firmware · HP
01.03.01 · source: NVD
ED
Elite Dragonfly Max Firmware · HP
01.10.00 · source: NVD
EF
Elite Folio 2-in-1 Firmware · HP
not_impacted · source: NVD
EX
Elite X2 1012 G1 Firmware · HP
1.57 · source: NVD
EX
Elite X2 1012 G2 Firmware · HP
1.43 · source: NVD
EX
Elite X2 1013 G3 Firmware · HP
01.21.01 · source: NVD
EX
Elite X2 G4 Firmware · HP
01.21.01 · source: NVD
EX
Elite X2 G8 Firmware · HP
01.10.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31645
Vendor Advisory
https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806
More from HP PC BIOS
8.2
CVE-2023-5410
A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering
7.8
CVE-2022-27540
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial…
7.8
CVE-2022-31646
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…
7.8
CVE-2022-31644
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…
7.8
CVE-2022-31639
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation…