Back to the CVE list
CVE-2021-39297

Improper privilege management in N/a BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT OF SALE SYSTEMS BIOS; WORKSTATIONS BIOS

CVSS score

7.8

EPSS probability

%0.4

Risk score

0.0

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-39297 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-39297 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1n/aBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS View
2hp260 g3 desktop mini pc firmware View
3hp260 g3 desktop mini pc View
4hpelitedesk 800 35w g4 desktop mini pc firmware View
5hpelitedesk 800 35w g4 desktop mini pc View
6hpelitedesk 800 65w g4 desktop mini pc firmware View
7hpelitedesk 800 65w g4 desktop mini pc View
8hpelitedesk 800 95w g4 desktop mini pc firmware View
9hpelitedesk 800 95w g4 desktop mini pc View
10hpelitedesk 800 g4 small form factor pc firmware View
11hpelitedesk 800 g4 small form factor pc View
12hpelitedesk 800 g4 tower pc firmware View
13hpelitedesk 800 g4 tower pc View
14hpelitedesk 800 g4 workstation edition firmware View
15hpelitedesk 800 g4 workstation edition View
16hpelitedesk 800 g5 desktop mini pc firmware View
17hpelitedesk 800 g5 desktop mini pc View
18hpelitedesk 800 g5 small form factor pc firmware View
19hpelitedesk 800 g5 small form factor pc View
20hpelitedesk 800 g5 tower pc firmware View
21hpelitedesk 800 g5 tower pc View
22hpelitedesk 800 g6 desktop mini pc firmware View
23hpelitedesk 800 g6 desktop mini pc View
24hpelitedesk 800 g6 small form factor pc firmware View
25hpelitedesk 800 g6 small form factor pc View
26hpelitedesk 800 g6 tower pc firmware View
27hpelitedesk 800 g6 tower pc View
28hpelitedesk 800 g8 desktop mini pc firmware View
29hpelitedesk 800 g8 desktop mini pc View
30hpelitedesk 800 g8 small form factor pc firmware View
31hpelitedesk 800 g8 small form factor pc View
32hpelitedesk 800 g8 tower pc firmware View
33hpelitedesk 800 g8 tower pc View
34hpelitedesk 805 g6 desktop mini pc firmware View
35hpelitedesk 805 g6 desktop mini pc View
36hpelitedesk 805 g6 small form factor pc firmware View
37hpelitedesk 805 g6 small form factor pc View
38hpelitedesk 805 g8 desktop mini pc firmware View
39hpelitedesk 805 g8 desktop mini pc View
40hpelitedesk 805 g8 small form factor pc firmware View
41hpelitedesk 805 g8 small form factor pc View
42hpelitedesk 880 g4 tower pc firmware View
43hpelitedesk 880 g4 tower pc View
44hpelitedesk 880 g5 tower pc firmware View
45hpelitedesk 880 g5 tower pc View
46hpelitedesk 880 g6 tower pc firmware View
47hpelitedesk 880 g6 tower pc View
48hpelitedesk 880 g8 tower pc firmware View
49hpelitedesk 880 g8 tower pc View
50hpeliteone 1000 g2 23.8-in all-in-one business pc firmware View
51hpeliteone 1000 g2 23.8-in all-in-one business pc View
52hpeliteone 1000 g2 23.8-in touch all-in-one business pc firmware View
53hpeliteone 1000 g2 23.8-in touch all-in-one business pc View
54hpeliteone 1000 g2 27-in 4k uhd all-in-one business pc firmware View
55hpeliteone 1000 g2 27-in 4k uhd all-in-one business pc View
56hpeliteone 1000 g2 34-in curved all-in-one business pc firmware View
57hpeliteone 1000 g2 34-in curved all-in-one business pc View
58hpeliteone 800 g4 23.8-in healthcare edition all-in-one business pc firmware View
59hpeliteone 800 g4 23.8-in healthcare edition all-in-one business pc View
60hpeliteone 800 g4 23.8-inch non-touch all-in-one pc firmware View
61hpeliteone 800 g4 23.8-inch non-touch all-in-one pc View
62hpeliteone 800 g4 23.8-inch non-touch gpu all-in-one pc firmware View
63hpeliteone 800 g4 23.8-inch non-touch gpu all-in-one pc View
64hpeliteone 800 g4 23.8-inch touch all-in-one pc firmware View
65hpeliteone 800 g4 23.8-inch touch all-in-one pc View
66hpeliteone 800 g4 23.8-inch touch gpu all-in-one pc firmware View
67hpeliteone 800 g4 23.8-inch touch gpu all-in-one pc View
68hpeliteone 800 g5 23.8-in healthcare edition all-in-one firmware View
69hpeliteone 800 g5 23.8-in healthcare edition all-in-one View
70hpeliteone 800 g5 23.8-inch all-in-one firmware View
71hpeliteone 800 g5 23.8-inch all-in-one View
72hpeliteone 800 g6 24 all-in-one pc firmware View
73hpeliteone 800 g6 24 all-in-one pc View
74hpeliteone 800 g6 27 all-in-one pc firmware View
75hpeliteone 800 g6 27 all-in-one pc View
76hpeliteone 800 g8 24 all-in-one pc firmware View
77hpeliteone 800 g8 24 all-in-one pc View
78hpeliteone 800 g8 27 all-in-one pc firmware View
79hpeliteone 800 g8 27 all-in-one pc View
80hpprodesk 400 g4 desktop mini pc firmware View
81hpprodesk 400 g4 desktop mini pc View
82hpprodesk 400 g5 desktop mini pc firmware View
83hpprodesk 400 g5 desktop mini pc View
84hpprodesk 400 g5 microtower pc firmware View
85hpprodesk 400 g5 microtower pc View
86hpprodesk 400 g5 small form factor pc firmware View
87hpprodesk 400 g5 small form factor pc View
88hpprodesk 400 g6 desktop mini pc firmware View
89hpprodesk 400 g6 desktop mini pc View
90hpprodesk 400 g6 microtower pc firmware View
91hpprodesk 400 g6 microtower pc View
92hpprodesk 400 g6 small form factor pc firmware View
93hpprodesk 400 g6 small form factor pc View
94hpprodesk 400 g7 microtower pc firmware View
95hpprodesk 400 g7 microtower pc View
96hpprodesk 400 g7 small form factor pc firmware View
97hpprodesk 400 g7 small form factor pc View
98hpprodesk 405 g8 desktop mini pc firmware View
99hpprodesk 405 g8 desktop mini pc View
100hpprodesk 405 g8 small form factor pc firmware View
101hpprodesk 405 g8 small form factor pc View
102hpprodesk 480 g5 microtower pc firmware View
103hpprodesk 480 g5 microtower pc View
104hpprodesk 480 g6 microtower pc firmware View
105hpprodesk 480 g6 microtower pc View
106hpprodesk 480 g7 pci microtower pc firmware View
107hpprodesk 480 g7 pci microtower pc View
108hpprodesk 600 g4 desktop mini pc firmware View
109hpprodesk 600 g4 desktop mini pc View
110hpprodesk 600 g4 microtower pc firmware View
111hpprodesk 600 g4 microtower pc View
112hpprodesk 600 g4 microtower pc(with pci slot) firmware View
113hpprodesk 600 g4 microtower pc(with pci slot) View
114hpprodesk 600 g4 small form factor pc firmware View
115hpprodesk 600 g4 small form factor pc View
116hpprodesk 600 g5 desktop mini pc firmware View
117hpprodesk 600 g5 desktop mini pc View
118hpprodesk 600 g5 microtower pc firmware View
119hpprodesk 600 g5 microtower pc View
120hpprodesk 600 g5 microtower pc(with pci slot) firmware View
121hpprodesk 600 g5 microtower pc(with pci slot) View
122hpprodesk 600 g5 small form factor pc firmware View
123hpprodesk 600 g5 small form factor pc View
124hpprodesk 600 g6 desktop mini pc firmware View
125hpprodesk 600 g6 desktop mini pc View
126hpprodesk 600 g6 microtower pc firmware View
127hpprodesk 600 g6 microtower pc View
128hpprodesk 600 g6 small form factor pc firmware View
129hpprodesk 600 g6 small form factor pc View
130hpprodesk 680 g4 microtower pc firmware View
131hpprodesk 680 g4 microtower pc View
132hpprodesk 680 g4 microtower pc(with pci slot) firmware View
133hpprodesk 680 g4 microtower pc(with pci slot) View
134hpprodesk 680 g6 pci microtower pc firmware View
135hpprodesk 680 g6 pci microtower pc View
136hpproone 400 g4 20-inch non-touch all-in-one business pc firmware View
137hpproone 400 g4 20-inch non-touch all-in-one business pc View
138hpproone 400 g4 23.8-inch non-touch all-in-one business pc firmware View
139hpproone 400 g4 23.8-inch non-touch all-in-one business pc View
140hpproone 400 g5 20-inch all-in-one business pc firmware View
141hpproone 400 g5 20-inch all-in-one business pc View
142hpproone 400 g5 23.8-inch all-in-one business pc firmware View
143hpproone 400 g5 23.8-inch all-in-one business pc View
144hpproone 400 g6 20 all-in-one pc firmware View
145hpproone 400 g6 20 all-in-one pc View
146hpproone 400 g6 24 all-in-one pc firmware View
147hpproone 400 g6 24 all-in-one pc View
148hpproone 440 g4 23.8-inch non-touch all-in-one business pc firmware View
149hpproone 440 g4 23.8-inch non-touch all-in-one business pc View
150hpproone 440 g5 23.8-in all-in-one business pc firmware View
151hpproone 440 g5 23.8-in all-in-one business pc View
152hpproone 440 g6 24 all-in-one pc firmware View
153hpproone 440 g6 24 all-in-one pc View
154hpproone 600 g4 21.5-inch touch all-in-one business pc firmware View
155hpproone 600 g4 21.5-inch touch all-in-one business pc View
156hpproone 600 g5 21.5-in all-in-one business pc firmware View
157hpproone 600 g5 21.5-in all-in-one business pc View
158hpproone 600 g6 22 all-in-one pc firmware View
159hpproone 600 g6 22 all-in-one pc View
160hpzhan 66 pro g3 22 all-in-one pc firmware View
161hpzhan 66 pro g3 22 all-in-one pc View
162hpzhan 66 pro g3 24 all-in-one pc firmware View
163hpzhan 66 pro g3 24 all-in-one pc View
164hpz1 entry tower g5 workstation firmware View
165hpz1 entry tower g5 workstation View
166hpz1 entry tower g6 workstation firmware View
167hpz1 entry tower g6 workstation View
168hpz1 g8 tower desktop pc firmware View
169hpz1 g8 tower desktop pc View
170hpz4 g4 workstation (core-x) firmware View
171hpz4 g4 workstation (core-x) View
172hpz4 g4 workstation (xeon w) firmware View
173hpz4 g4 workstation (xeon w) View
174hpz6 g4 workstation firmware View
175hpz6 g4 workstation View
176hpz8 g4 workstation firmware View
177hpz8 g4 workstation View
178hpengage flex mini retail system firmware View
179hpengage flex mini retail system View
180hpmp9 g4 retail system firmware View
181hpmp9 g4 retail system View
182hpelite dragonfly firmware View
183hpelite dragonfly View
184hpelite dragonfly g2 firmware View
185hpelite dragonfly g2 View
186hpelite dragonfly max firmware View
187hpelite dragonfly max View
188hpelite x2 1013 g3 firmware View
189hpelite x2 1013 g3 View
190hpelite x2 g4 firmware View
191hpelite x2 g4 View
192hpelite x2 g8 tablet firmware View
193hpelite x2 g8 tablet View
194hpelitebook 1050 g1 firmware View
195hpelitebook 1050 g1 View
196hpelitebook 830 g5 firmware View
197hpelitebook 830 g5 View
198hpelitebook 830 g6 firmware View
199hpelitebook 830 g6 View
200hpelitebook 830 g7 firmware View
Total affected vendors: 2|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
7.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
7.8CVSS V3_1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE ADP
7.2CVSS V2—AV:L/AC:L/Au:N/C:C/I:C/A:CNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-39297 is associated with the following CWEs:

CWE-269: Common Weakness Enumeration Entry CWE-269

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-39297 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsLow
UserGerekmiyor

Official Sources and Advisories

https://support.hp.com/us-en/document/ish_5661066-5661090-16vendor-advisory

CVSS Vector Radar Chart

7.8 / 10
Attack VectorLocalComplexityLowPrivilegesLowUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow privileges
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

N
n/a logo
n/a
H
hp logo
hp

Weakness Type (CWE & CAPEC)

CWE-269

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-39297"