High severity · published Oct 18, 2023
CVE-2023-26300
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2P
200 Pro G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f2) Firmware · HP
before f.50 · source: NVD
2G
205 G4 22 All-in-one PC (rom Family Ssid 86f3) Firmware · HP
before f.50 · source: NVD
2G
205 G8 24 All-in-one PC (rom Family Ssid 8923) Firmware · HP
before f.20 · source: NVD
2G
205 G8 24 All-in-one PC (rom Family Ssid 8924) Firmware · HP
before f.20 · source: NVD
2P
205 Pro G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware · HP
before f.50 · source: NVD
Affected product
2G
200 G4 22 All-in-one PC (rom Family Ssid 86f0) Firmware
HP