High severity · published Dec 12, 2022
CVE-2022-37018
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Elite Slice Firmware · HP
before 02.59 · source: NVD
EX
Elite X2 1012 G1 Firmware · HP
before 01.58 · source: NVD
EX
Elite X2 1012 G2 Firmware · HP
before 01.44 · source: NVD
E1
Elitebook 1030 G1 Firmware · HP
before 01.58 · source: NVD
E1
Elitebook 1040 G3 Firmware · HP
before 01.58 · source: NVD
E1
Elitebook 1040 G4 Firmware · HP
before 01.44 · source: NVD
E8
Elitebook 820 G3 Firmware · HP
before 01.58 · source: NVD
E8
Elitebook 820 G4 Firmware · HP
before 01.44 · source: NVD
E8
Elitebook 828 G3 Firmware · HP
before 01.58 · source: NVD
E8
Elitebook 828 G4 Firmware · HP
before 01.44 · source: NVD
E8
Elitebook 840 G3 Firmware · HP
before 01.58 · source: NVD
E8
Elitebook 840 G4 Firmware · HP
before 01.44 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37018
Patch
https://support.hp.com/us-en/document/ish_7191946-7191970-16/hpsbhf03820
More from Elite Slice Firmware
7.2
CVE-2019-16284
A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can…
6.8
CVE-2022-37020
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution
6.8
CVE-2022-37019
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution