High severity · published Feb 16, 2022
CVE-2021-39297
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BN
BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS ·
before 01.12.00; before 01.08.00; before 01.19.00; before 01.08.02; before 01.08.01; before 02.17.00; +7 more · source: vendor
2G
260 G3 Desktop Mini PC Firmware · HP
through 2.17.00 · source: NVD
E8
Elitedesk 800 35w G4 Desktop Mini PC Firmware · HP
through 2.18.00 · source: NVD
E8
Elitedesk 800 65w G4 Desktop Mini PC Firmware · HP
through 2.18.00 · source: NVD
E8
Elitedesk 800 95w G4 Desktop Mini PC Firmware · HP
through 2.18.00 · source: NVD
E8
Elitedesk 800 G4 Small Form Factor PC Firmware · HP
through 2.18.00 · source: NVD
E8
Elitedesk 800 G4 Tower PC Firmware · HP
through 2.18.00; through 2.18.00 · source: NVD
E8
Elitedesk 800 G4 Workstation Edition Firmware · HP
through 2.18.00 · source: NVD
E8
Elitedesk 800 G5 Desktop Mini PC Firmware · HP
through 2.12.00 · source: NVD
E8
Elitedesk 800 G5 Small Form Factor PC Firmware · HP
through 2.12.00 · source: NVD
E8
Elitedesk 800 G5 Tower PC Firmware · HP
through 2.12.00 · source: NVD
E8
Elitedesk 800 G6 Desktop Mini PC Firmware · HP
through 2.10.00 · source: NVD
Affected product
BN
BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39297
x_refsource_MISC
https://support.hp.com/us-en/document/ish_5661066-5661090-16
More from BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS
8.8
CVE-2021-39300
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39299
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39301
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution