High severity · published Feb 1, 2023
CVE-2021-3809
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Elite Dragonfly Firmware · HP
01.12.00 · source: NVD
EX
Elite X2 1012 G2 Firmware · HP
1.41 · source: NVD
EX
Elite X2 1013 G3 Firmware · HP
01.19.00 · source: NVD
EX
Elite X2 G4 Firmware · HP
01.12.00 · source: NVD
E1
Elitebook 1040 G4 Firmware · HP
1.41 · source: NVD
E1
Elitebook 1050 G1 Firmware · HP
01.19.00 · source: NVD
E7
Elitebook 725 G4 Firmware · HP
1.4 · source: NVD
E7
Elitebook 735 G5 Firmware · HP
01.20.00 · source: NVD
E7
Elitebook 735 G6 Firmware · HP
01.19.00 · source: NVD
E7
Elitebook 745 G4 Firmware · HP
1.4 · source: NVD
E7
Elitebook 745 G5 Firmware · HP
01.20.00 · source: NVD
E7
Elitebook 745 G6 Firmware · HP
01.19.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3809
Vendor Advisory
https://support.hp.com/us-en/document/ish_6184733-6184761-16/hpsbhf03788
More from Elite Dragonfly Firmware
8.8
CVE-2021-39300
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39299
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39301
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39298
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution…
7.8
CVE-2022-27540
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial…