Medium severity · published Jun 10, 2024
CVE-2022-37020
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Elite Slice Firmware · HP
before 00.02.64 · source: NVD
ES
Elite Slice For Meeting Rooms Firmware · HP
before 00.02.64 · source: NVD
E1
Elitebook 1040 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 820 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 828 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 840 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 848 G3 Firmware · HP
before 01.62 · source: NVD
E8
Elitebook 850 G3 Firmware · HP
before 01.62 · source: NVD
EF
Elitebook Folio G1 Firmware · HP
before 01.62 · source: NVD
E8
Elitedesk 800 35w G2 Desktop Mini PC Firmware · HP
before 00.02.63 · source: NVD
E8
Elitedesk 800 65w G2 Desktop Mini PC Firmware · HP
before 00.02.63 · source: NVD
MG
Mp9 G2 Retail System Firmware · HP
before 02.63 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37020
Vendor Advisory
https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943
More from Elite Slice Firmware
8.4
CVE-2022-37018
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution
7.2
CVE-2019-16284
A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can…
6.8
CVE-2022-37019
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution