High severity · published Feb 12, 2023
CVE-2022-43779
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary…
7.0
CVSS
0.1%
EPSS
No
On KEV
Description
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2P
218 Pro G5 MT Firmware · HP
before f15 · source: NVD
2G
260 G2 Desktop Mini Firmware · HP
before 2.26 · source: NVD
2G
260 G3 Desktop Mini Firmware · HP
before 02.20.00 · source: NVD
2G
260 G4 Desktop Mini Firmware · HP
before 02.12.00 · source: NVD
2G
280 G3 Microtower PC Firmware · HP
before 02.02.40 · source: NVD
2G
280 G3 Pci Microtower PC Firmware · HP
before 02.02.40 · source: NVD
2P
288 Pro G3 Microtower PC Firmware · HP
before 00.02.40 · source: NVD
2G
290 G1 Microtower Firmware · HP
before 00.02.40 · source: NVD
3G
348 G4 Firmware · HP
before f.65 · source: NVD
DP
Desktop Pro 300 G3 Firmware · HP
before f15 · source: NVD
DP
Desktop Pro A 300 G3 Firmware · HP
before f12 · source: NVD
DP
Desktop Pro A G2 Firmware · HP
before f.11 · source: NVD