CVE-2021-39297
Improper privilege management in N/a BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT OF SALE SYSTEMS BIOS; WORKSTATIONS BIOS
CVSS Skor
7.8
EPSS İhtimal
%0.4
Risk Skoru
0.0
Yayın
4 yıl önce
Resmî yama doğrulandı
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Envanterimdeki Etkisi
Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.
Oturum kontrol ediliyor…
Zafiyet Açıklaması
DayBreach CVE AI Araştırması
CVE-2021-39297 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
IMPACT — Etkilenen Ürünler ve Yazılımlar
Affected Products
The following products are affected by CVE-2021-39297 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | n/a | BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS | İncele |
| 2 | hp | 260 g3 desktop mini pc firmware | İncele |
| 3 | hp | 260 g3 desktop mini pc | İncele |
| 4 | hp | elitedesk 800 35w g4 desktop mini pc firmware | İncele |
| 5 | hp | elitedesk 800 35w g4 desktop mini pc | İncele |
| 6 | hp | elitedesk 800 65w g4 desktop mini pc firmware | İncele |
| 7 | hp | elitedesk 800 65w g4 desktop mini pc | İncele |
| 8 | hp | elitedesk 800 95w g4 desktop mini pc firmware | İncele |
| 9 | hp | elitedesk 800 95w g4 desktop mini pc | İncele |
| 10 | hp | elitedesk 800 g4 small form factor pc firmware | İncele |
| 11 | hp | elitedesk 800 g4 small form factor pc | İncele |
| 12 | hp | elitedesk 800 g4 tower pc firmware | İncele |
| 13 | hp | elitedesk 800 g4 tower pc | İncele |
| 14 | hp | elitedesk 800 g4 workstation edition firmware | İncele |
| 15 | hp | elitedesk 800 g4 workstation edition | İncele |
| 16 | hp | elitedesk 800 g5 desktop mini pc firmware | İncele |
| 17 | hp | elitedesk 800 g5 desktop mini pc | İncele |
| 18 | hp | elitedesk 800 g5 small form factor pc firmware | İncele |
| 19 | hp | elitedesk 800 g5 small form factor pc | İncele |
| 20 | hp | elitedesk 800 g5 tower pc firmware | İncele |
| 21 | hp | elitedesk 800 g5 tower pc | İncele |
| 22 | hp | elitedesk 800 g6 desktop mini pc firmware | İncele |
| 23 | hp | elitedesk 800 g6 desktop mini pc | İncele |
| 24 | hp | elitedesk 800 g6 small form factor pc firmware | İncele |
| 25 | hp | elitedesk 800 g6 small form factor pc | İncele |
| 26 | hp | elitedesk 800 g6 tower pc firmware | İncele |
| 27 | hp | elitedesk 800 g6 tower pc | İncele |
| 28 | hp | elitedesk 800 g8 desktop mini pc firmware | İncele |
| 29 | hp | elitedesk 800 g8 desktop mini pc | İncele |
| 30 | hp | elitedesk 800 g8 small form factor pc firmware | İncele |
| 31 | hp | elitedesk 800 g8 small form factor pc | İncele |
| 32 | hp | elitedesk 800 g8 tower pc firmware | İncele |
| 33 | hp | elitedesk 800 g8 tower pc | İncele |
| 34 | hp | elitedesk 805 g6 desktop mini pc firmware | İncele |
| 35 | hp | elitedesk 805 g6 desktop mini pc | İncele |
| 36 | hp | elitedesk 805 g6 small form factor pc firmware | İncele |
| 37 | hp | elitedesk 805 g6 small form factor pc | İncele |
| 38 | hp | elitedesk 805 g8 desktop mini pc firmware | İncele |
| 39 | hp | elitedesk 805 g8 desktop mini pc | İncele |
| 40 | hp | elitedesk 805 g8 small form factor pc firmware | İncele |
| 41 | hp | elitedesk 805 g8 small form factor pc | İncele |
| 42 | hp | elitedesk 880 g4 tower pc firmware | İncele |
| 43 | hp | elitedesk 880 g4 tower pc | İncele |
| 44 | hp | elitedesk 880 g5 tower pc firmware | İncele |
| 45 | hp | elitedesk 880 g5 tower pc | İncele |
| 46 | hp | elitedesk 880 g6 tower pc firmware | İncele |
| 47 | hp | elitedesk 880 g6 tower pc | İncele |
| 48 | hp | elitedesk 880 g8 tower pc firmware | İncele |
| 49 | hp | elitedesk 880 g8 tower pc | İncele |
| 50 | hp | eliteone 1000 g2 23.8-in all-in-one business pc firmware | İncele |
| 51 | hp | eliteone 1000 g2 23.8-in all-in-one business pc | İncele |
| 52 | hp | eliteone 1000 g2 23.8-in touch all-in-one business pc firmware | İncele |
| 53 | hp | eliteone 1000 g2 23.8-in touch all-in-one business pc | İncele |
| 54 | hp | eliteone 1000 g2 27-in 4k uhd all-in-one business pc firmware | İncele |
| 55 | hp | eliteone 1000 g2 27-in 4k uhd all-in-one business pc | İncele |
| 56 | hp | eliteone 1000 g2 34-in curved all-in-one business pc firmware | İncele |
| 57 | hp | eliteone 1000 g2 34-in curved all-in-one business pc | İncele |
| 58 | hp | eliteone 800 g4 23.8-in healthcare edition all-in-one business pc firmware | İncele |
| 59 | hp | eliteone 800 g4 23.8-in healthcare edition all-in-one business pc | İncele |
| 60 | hp | eliteone 800 g4 23.8-inch non-touch all-in-one pc firmware | İncele |
| 61 | hp | eliteone 800 g4 23.8-inch non-touch all-in-one pc | İncele |
| 62 | hp | eliteone 800 g4 23.8-inch non-touch gpu all-in-one pc firmware | İncele |
| 63 | hp | eliteone 800 g4 23.8-inch non-touch gpu all-in-one pc | İncele |
| 64 | hp | eliteone 800 g4 23.8-inch touch all-in-one pc firmware | İncele |
| 65 | hp | eliteone 800 g4 23.8-inch touch all-in-one pc | İncele |
| 66 | hp | eliteone 800 g4 23.8-inch touch gpu all-in-one pc firmware | İncele |
| 67 | hp | eliteone 800 g4 23.8-inch touch gpu all-in-one pc | İncele |
| 68 | hp | eliteone 800 g5 23.8-in healthcare edition all-in-one firmware | İncele |
| 69 | hp | eliteone 800 g5 23.8-in healthcare edition all-in-one | İncele |
| 70 | hp | eliteone 800 g5 23.8-inch all-in-one firmware | İncele |
| 71 | hp | eliteone 800 g5 23.8-inch all-in-one | İncele |
| 72 | hp | eliteone 800 g6 24 all-in-one pc firmware | İncele |
| 73 | hp | eliteone 800 g6 24 all-in-one pc | İncele |
| 74 | hp | eliteone 800 g6 27 all-in-one pc firmware | İncele |
| 75 | hp | eliteone 800 g6 27 all-in-one pc | İncele |
| 76 | hp | eliteone 800 g8 24 all-in-one pc firmware | İncele |
| 77 | hp | eliteone 800 g8 24 all-in-one pc | İncele |
| 78 | hp | eliteone 800 g8 27 all-in-one pc firmware | İncele |
| 79 | hp | eliteone 800 g8 27 all-in-one pc | İncele |
| 80 | hp | prodesk 400 g4 desktop mini pc firmware | İncele |
| 81 | hp | prodesk 400 g4 desktop mini pc | İncele |
| 82 | hp | prodesk 400 g5 desktop mini pc firmware | İncele |
| 83 | hp | prodesk 400 g5 desktop mini pc | İncele |
| 84 | hp | prodesk 400 g5 microtower pc firmware | İncele |
| 85 | hp | prodesk 400 g5 microtower pc | İncele |
| 86 | hp | prodesk 400 g5 small form factor pc firmware | İncele |
| 87 | hp | prodesk 400 g5 small form factor pc | İncele |
| 88 | hp | prodesk 400 g6 desktop mini pc firmware | İncele |
| 89 | hp | prodesk 400 g6 desktop mini pc | İncele |
| 90 | hp | prodesk 400 g6 microtower pc firmware | İncele |
| 91 | hp | prodesk 400 g6 microtower pc | İncele |
| 92 | hp | prodesk 400 g6 small form factor pc firmware | İncele |
| 93 | hp | prodesk 400 g6 small form factor pc | İncele |
| 94 | hp | prodesk 400 g7 microtower pc firmware | İncele |
| 95 | hp | prodesk 400 g7 microtower pc | İncele |
| 96 | hp | prodesk 400 g7 small form factor pc firmware | İncele |
| 97 | hp | prodesk 400 g7 small form factor pc | İncele |
| 98 | hp | prodesk 405 g8 desktop mini pc firmware | İncele |
| 99 | hp | prodesk 405 g8 desktop mini pc | İncele |
| 100 | hp | prodesk 405 g8 small form factor pc firmware | İncele |
| 101 | hp | prodesk 405 g8 small form factor pc | İncele |
| 102 | hp | prodesk 480 g5 microtower pc firmware | İncele |
| 103 | hp | prodesk 480 g5 microtower pc | İncele |
| 104 | hp | prodesk 480 g6 microtower pc firmware | İncele |
| 105 | hp | prodesk 480 g6 microtower pc | İncele |
| 106 | hp | prodesk 480 g7 pci microtower pc firmware | İncele |
| 107 | hp | prodesk 480 g7 pci microtower pc | İncele |
| 108 | hp | prodesk 600 g4 desktop mini pc firmware | İncele |
| 109 | hp | prodesk 600 g4 desktop mini pc | İncele |
| 110 | hp | prodesk 600 g4 microtower pc firmware | İncele |
| 111 | hp | prodesk 600 g4 microtower pc | İncele |
| 112 | hp | prodesk 600 g4 microtower pc(with pci slot) firmware | İncele |
| 113 | hp | prodesk 600 g4 microtower pc(with pci slot) | İncele |
| 114 | hp | prodesk 600 g4 small form factor pc firmware | İncele |
| 115 | hp | prodesk 600 g4 small form factor pc | İncele |
| 116 | hp | prodesk 600 g5 desktop mini pc firmware | İncele |
| 117 | hp | prodesk 600 g5 desktop mini pc | İncele |
| 118 | hp | prodesk 600 g5 microtower pc firmware | İncele |
| 119 | hp | prodesk 600 g5 microtower pc | İncele |
| 120 | hp | prodesk 600 g5 microtower pc(with pci slot) firmware | İncele |
| 121 | hp | prodesk 600 g5 microtower pc(with pci slot) | İncele |
| 122 | hp | prodesk 600 g5 small form factor pc firmware | İncele |
| 123 | hp | prodesk 600 g5 small form factor pc | İncele |
| 124 | hp | prodesk 600 g6 desktop mini pc firmware | İncele |
| 125 | hp | prodesk 600 g6 desktop mini pc | İncele |
| 126 | hp | prodesk 600 g6 microtower pc firmware | İncele |
| 127 | hp | prodesk 600 g6 microtower pc | İncele |
| 128 | hp | prodesk 600 g6 small form factor pc firmware | İncele |
| 129 | hp | prodesk 600 g6 small form factor pc | İncele |
| 130 | hp | prodesk 680 g4 microtower pc firmware | İncele |
| 131 | hp | prodesk 680 g4 microtower pc | İncele |
| 132 | hp | prodesk 680 g4 microtower pc(with pci slot) firmware | İncele |
| 133 | hp | prodesk 680 g4 microtower pc(with pci slot) | İncele |
| 134 | hp | prodesk 680 g6 pci microtower pc firmware | İncele |
| 135 | hp | prodesk 680 g6 pci microtower pc | İncele |
| 136 | hp | proone 400 g4 20-inch non-touch all-in-one business pc firmware | İncele |
| 137 | hp | proone 400 g4 20-inch non-touch all-in-one business pc | İncele |
| 138 | hp | proone 400 g4 23.8-inch non-touch all-in-one business pc firmware | İncele |
| 139 | hp | proone 400 g4 23.8-inch non-touch all-in-one business pc | İncele |
| 140 | hp | proone 400 g5 20-inch all-in-one business pc firmware | İncele |
| 141 | hp | proone 400 g5 20-inch all-in-one business pc | İncele |
| 142 | hp | proone 400 g5 23.8-inch all-in-one business pc firmware | İncele |
| 143 | hp | proone 400 g5 23.8-inch all-in-one business pc | İncele |
| 144 | hp | proone 400 g6 20 all-in-one pc firmware | İncele |
| 145 | hp | proone 400 g6 20 all-in-one pc | İncele |
| 146 | hp | proone 400 g6 24 all-in-one pc firmware | İncele |
| 147 | hp | proone 400 g6 24 all-in-one pc | İncele |
| 148 | hp | proone 440 g4 23.8-inch non-touch all-in-one business pc firmware | İncele |
| 149 | hp | proone 440 g4 23.8-inch non-touch all-in-one business pc | İncele |
| 150 | hp | proone 440 g5 23.8-in all-in-one business pc firmware | İncele |
| 151 | hp | proone 440 g5 23.8-in all-in-one business pc | İncele |
| 152 | hp | proone 440 g6 24 all-in-one pc firmware | İncele |
| 153 | hp | proone 440 g6 24 all-in-one pc | İncele |
| 154 | hp | proone 600 g4 21.5-inch touch all-in-one business pc firmware | İncele |
| 155 | hp | proone 600 g4 21.5-inch touch all-in-one business pc | İncele |
| 156 | hp | proone 600 g5 21.5-in all-in-one business pc firmware | İncele |
| 157 | hp | proone 600 g5 21.5-in all-in-one business pc | İncele |
| 158 | hp | proone 600 g6 22 all-in-one pc firmware | İncele |
| 159 | hp | proone 600 g6 22 all-in-one pc | İncele |
| 160 | hp | zhan 66 pro g3 22 all-in-one pc firmware | İncele |
| 161 | hp | zhan 66 pro g3 22 all-in-one pc | İncele |
| 162 | hp | zhan 66 pro g3 24 all-in-one pc firmware | İncele |
| 163 | hp | zhan 66 pro g3 24 all-in-one pc | İncele |
| 164 | hp | z1 entry tower g5 workstation firmware | İncele |
| 165 | hp | z1 entry tower g5 workstation | İncele |
| 166 | hp | z1 entry tower g6 workstation firmware | İncele |
| 167 | hp | z1 entry tower g6 workstation | İncele |
| 168 | hp | z1 g8 tower desktop pc firmware | İncele |
| 169 | hp | z1 g8 tower desktop pc | İncele |
| 170 | hp | z4 g4 workstation (core-x) firmware | İncele |
| 171 | hp | z4 g4 workstation (core-x) | İncele |
| 172 | hp | z4 g4 workstation (xeon w) firmware | İncele |
| 173 | hp | z4 g4 workstation (xeon w) | İncele |
| 174 | hp | z6 g4 workstation firmware | İncele |
| 175 | hp | z6 g4 workstation | İncele |
| 176 | hp | z8 g4 workstation firmware | İncele |
| 177 | hp | z8 g4 workstation | İncele |
| 178 | hp | engage flex mini retail system firmware | İncele |
| 179 | hp | engage flex mini retail system | İncele |
| 180 | hp | mp9 g4 retail system firmware | İncele |
| 181 | hp | mp9 g4 retail system | İncele |
| 182 | hp | elite dragonfly firmware | İncele |
| 183 | hp | elite dragonfly | İncele |
| 184 | hp | elite dragonfly g2 firmware | İncele |
| 185 | hp | elite dragonfly g2 | İncele |
| 186 | hp | elite dragonfly max firmware | İncele |
| 187 | hp | elite dragonfly max | İncele |
| 188 | hp | elite x2 1013 g3 firmware | İncele |
| 189 | hp | elite x2 1013 g3 | İncele |
| 190 | hp | elite x2 g4 firmware | İncele |
| 191 | hp | elite x2 g4 | İncele |
| 192 | hp | elite x2 g8 tablet firmware | İncele |
| 193 | hp | elite x2 g8 tablet | İncele |
| 194 | hp | elitebook 1050 g1 firmware | İncele |
| 195 | hp | elitebook 1050 g1 | İncele |
| 196 | hp | elitebook 830 g5 firmware | İncele |
| 197 | hp | elitebook 830 g5 | İncele |
| 198 | hp | elitebook 830 g6 firmware | İncele |
| 199 | hp | elitebook 830 g6 | İncele |
| 200 | hp | elitebook 830 g7 firmware | İncele |
RED HAT CSAF/VEX — Ürün Etki Kontrolü
Red Hat bu CVE için henüz bir CSAF/VEX etki kaydı yayımlamamış. Bu durum “etkilenmiyor” anlamına gelmez.
SCORING — CVSS Çoklu Kaynak Skoru
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 8.8 | CVSS V31 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD |
| 7.8 | CVSS V31 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD |
| 7.8 | CVSS V3_1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CVE ADP |
| 7.2 | CVSS V2 | — | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD |
Yama ve İyileştirme Rehberi (Solution)
Solution & Remediation Advisory
1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.
Public exploit ve aktif sömürü durumu
Doğrulanmış exploit istihbaratı
Bu CVE için henüz doğrulanmış public PoC, exploit repository’si veya Metasploit modülü bulunamadı.
Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-39297 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-39297 weaknesses.
Saldırı Vektörü ve Erişilebilirlik Karakteristiği
ErişimYerel erişim
YetkiDüşük
KullanıcıGerekmiyor
Resmi Kaynaklar ve Danışma Bültenleri
İlgili Benzer Açıklar
10.0
CVE-2015-3306 Aktif sömürülüyorImproper access control in N/a
Geçici çözüm Public Exploits:5EPSS %99
9.8
CVE-2021-21985 Aktif sömürülüyorVulnerability in N/a VMware vCenter Server And VMware Cloud Foundation
Geçici çözüm Public Exploits:10EPSS %100
9.8
CVE-2019-19781 Aktif sömürülüyorVulnerability in N/a
Geçici çözüm Public Exploits:13EPSS %100
9.8
CVE-2021-21972 Aktif sömürülüyorVulnerability in N/a VMware vCenter Server
Geçici çözüm Public Exploits:11EPSS %100
9.8
CVE-2019-15107 Aktif sömürülüyorVulnerability in N/a
Geçici çözüm Public Exploits:13EPSS %100
9.8
CVE-2022-30333 Aktif sömürülüyorPath traversal in N/a
Yama doğrulandıEPSS %99
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-39297"