High severity · published Feb 16, 2022
CVE-2021-39300
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BN
BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS ·
before 01.12.00; before 01.08.00; before 01.19.00; before 01.08.02; before 01.08.01; before 02.17.00; +7 more · source: vendor
ED
Elite Dragonfly Firmware · HP
before 01.12.00 · source: NVD
ED
Elite Dragonfly G2 Firmware · HP
before 01.08.00 · source: NVD
ED
Elite Dragonfly Max Firmware · HP
before 01.08.00 · source: NVD
EX
Elite X2 1013 G3 Firmware · HP
before 01.19.00 · source: NVD
EX
Elite X2 G4 Firmware · HP
before 01.12.00 · source: NVD
EX
Elite X2 G8 Tablet Firmware · HP
before 01.08.00 · source: NVD
E1
Elitebook 1050 G1 Firmware · HP
before 01.19.00 · source: NVD
E8
Elitebook 830 G5 Firmware · HP
before 01.19.00 · source: NVD
E8
Elitebook 830 G6 Firmware · HP
before 01.12.00 · source: NVD
E8
Elitebook 830 G7 Firmware · HP
before 01.08.00 · source: NVD
E8
Elitebook 830 G8 Firmware · HP
before 01.08.00 · source: NVD
Affected product
BN
BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39300
x_refsource_MISC
https://support.hp.com/us-en/document/ish_5661066-5661090-16
More from BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS
8.8
CVE-2021-39299
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39301
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution
8.8
CVE-2021-39297
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution