High severity · published Jun 30, 2023
CVE-2023-26299
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary…
7.0
CVSS
0.1%
EPSS
No
On KEV
Description
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2G
200 G3 Firmware · HP
All versions, or not specified · source: NVD
2G
200 G4 22 All-in-one Firmware · HP
All versions, or not specified · source: NVD
2P
200 Pro G4 22 All-in-one Firmware · HP
All versions, or not specified · source: NVD
2G
205 G4 22 All-in-one Firmware · HP
All versions, or not specified · source: NVD
2P
205 Pro G4 22 All-in-one Firmware · HP
All versions, or not specified · source: NVD
2G
240 G10 Firmware · HP
before f.04 · source: NVD
2G
245 G6 Firmware · HP
before f.35 · source: NVD
2G
245 G7 Firmware · HP
before f.69 · source: NVD
2G
245 G8 Firmware · HP
before f.25 · source: NVD
2G
247 G8 Firmware · HP
before f.69 · source: NVD
2G
250 G10 Firmware · HP
before f.05 · source: NVD
2G
255 G10 Firmware · HP
before f.08 · source: NVD