Medium severity · published Jun 10, 2024
CVE-2022-37020
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
HP PC products · HP Inc.
See HP security bulletin reference for affected versions · source: vendor
ES
Elite Slice Firmware · HP
before 00.02.64 · source: NVD
ES
Elite Slice For Meeting Rooms Firmware · HP
before 00.02.64 · source: NVD
E1
Elitebook 1040 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 820 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 828 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 840 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 848 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 850 G3 Firmware · HP
before 01.62 · source: NVD
EF
Elitebook Folio G1 Firmware · HP
before 01.62 · source: NVD
E8
Elitedesk 800 35w G2 Desktop Mini PC Firmware · HP
before 00.02.63 · source: NVD
E8
Elitedesk 800 65w G2 Desktop Mini PC Firmware · HP
before 00.02.63 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37020
Vendor Advisory
https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943
More from HP PC products
7.8
CVE-2023-26300
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege
6.8
CVE-2022-37019
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows