High severity · published Jun 13, 2023
CVE-2022-31637
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation…
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Elite X2 1012 G1 Firmware · HP
through 1.57 · source: NVD
EX
Elite X2 1012 G1 Tablet Firmware · HP
through 1.57 · source: NVD
EX
Elite X2 1012 G1 Tablet With Travel Keyboard Firmware · HP
through 1.57 · source: NVD
EX
Elite X2 1012 G2 Firmware · HP
through 1.43 · source: NVD
E1
Elitebook 1030 G1 Firmware · HP
through 1.57 · source: NVD
E1
Elitebook 1040 G3 Firmware · HP
through 1.57 · source: NVD
E1
Elitebook 1040 G4 Firmware · HP
through 1.43 · source: NVD
E7
Elitebook 725 G3 Firmware · HP
through 1.55 · source: NVD
E7
Elitebook 725 G4 Firmware · HP
through 1.42 · source: NVD
E7
Elitebook 745 G3 Firmware · HP
through 1.55 · source: NVD
E7
Elitebook 745 G4 Firmware · HP
through 1.42 · source: NVD
E7
Elitebook 755 G3 Firmware · HP
through 1.55 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31637
Broken Link
https://support.hp.com/us-en/document/ish_7149996-7150021-16/hpsbhf03814
More from Elite X2 1012 G1 Firmware
8.4
CVE-2022-37018
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution
7.8
CVE-2022-27540
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial…
7.8
CVE-2022-31646
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…
7.8
CVE-2022-31645
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…
7.8
CVE-2022-31644
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of…