High severity · published Nov 5, 2019
CVE-2019-16284
A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can…
7.2
CVSS
2%
EPSS
No
On KEV
Description
A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can result in elevation of privilege. The EFI_BOOT_SERVICES structure might be overwritten by an attacker to execute arbitrary SMM (System Management Mode) code. A list of affected products and versions are available in https://support.hp.com/rs-en/document/c06456250.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2G
260 G1 DM Firmware · HP
before 2.27 · source: NVD
2P
280 Pro G1 Firmware · HP
before 80.3 · source: NVD
2G
285 G2 Firmware · HP
before a0.23 · source: NVD
3G
340 G3 Firmware · HP
before f.48 · source: NVD
3G
340 G4 Firmware · HP
before f.55 · source: NVD
3G
346 G3 Firmware · HP
before f.48 · source: NVD
3G
346 G4 Firmware · HP
before f.46 · source: NVD
3G
348 G3 Firmware · HP
before f.48 · source: NVD
3G
348 G4 Firmware · HP
before f.55 · source: NVD
ES
Elite Slice Firmware · HP
before 2.42 · source: NVD
EX
Elite X2 1011 G1 Firmware · HP
before 1.27 · source: NVD
EX
Elite X2 1012 G1 Firmware · HP
before 1.42 · source: NVD