CVE-2022-27538
high-risk
Published 2023-02-01
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
Do I need to act?
-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10
High
LOCAL
/ HIGH complexity
Affected Products (20)
Dragonfly Folio G3 2-In-1 Firmware
Elite Dragonfly G3 Firmware
Elite X2 G8 Tablet Firmware
Elite X360 1040 G9 2-In-1 Firmware
Elitebook 1040 G9 Firmware
Elitebook 630 G9 Firmware
Elitebook 640 G9 Firmware
Elitebook 645 G9 Firmware
Elitebook 650 G9 Firmware
Elitebook 655 G9 Firmware
Affected Vendors
51
/ 100
high-risk
Severity
18/34 · Moderate
Exploitability
0/34 · Minimal
Exposure
33/34 · Critical