High severity · published Jun 28, 2024
CVE-2022-27540
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial…
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dragonfly Folio 13.5 Inch G3 2-in-1 Notebook PC Firmware · HP
before 01.07.00 · source: NVD
ED
Elite Dragonfly 13.5 Inch G3 Notebook PC Firmware · HP
before 01.07.00 · source: NVD
ED
Elite Dragonfly Firmware · HP
before 01.26.00 · source: NVD
ED
Elite Dragonfly G2 Firmware · HP
before 01.11.00 · source: NVD
ED
Elite Dragonfly Max Firmware · HP
before 01.11.00 · source: NVD
EX
Elite X2 1012 G1 Firmware · HP
before 1.6 · source: NVD
EX
Elite X2 1012 G1 Tablet Firmware · HP
1.6 · source: NVD
EX
Elite X2 1012 G1 Tablet With Travel Keyboard Firmware · HP
1.6 · source: NVD
EX
Elite X2 1012 G2 Firmware · HP
1.48 · source: NVD
EX
Elite X2 1013 G3 Firmware · HP
01.28.00 · source: NVD
EX
Elite X2 G4 Firmware · HP
01.26.0 · source: NVD
EX
Elite X2 G8 Tablet Firmware · HP
before 01.11.00 · source: NVD
Affected product
DF
Dragonfly Folio 13.5 Inch G3 2-in-1 Notebook PC Firmware
HP