High severity · published Oct 18, 2023
CVE-2023-26300
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
HP PC products · HP Inc.
See HP Security Bulletin reference for affected versions. · source: vendor
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2G
205 G8 24 All-in-one PC (rom Family Ssid 8923) Firmware · HP
before f.20 · source: NVD
2G
205 G8 24 All-in-one PC (rom Family Ssid 8924) Firmware · HP
before f.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26300
Patch
https://support.hp.com/us-en/document/ish_9461800-9461828-16
More from HP PC products
6.8
CVE-2022-37020
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
6.8
CVE-2022-37019
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows