Back to the CVE list
CVE-2021-39299

Improper privilege management in N/a BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT OF SALE SYSTEMS BIOS; WORKSTATIONS BIOS

CVSS score

7.8

EPSS probability

%0.4

Risk score

0.0

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-39299 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-39299 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1n/aBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS View
2hpelite dragonfly firmware View
3hpelite dragonfly View
4hpelite dragonfly g2 firmware View
5hpelite dragonfly g2 View
6hpelite dragonfly max firmware View
7hpelite dragonfly max View
8hpelite x2 1013 g3 firmware View
9hpelite x2 1013 g3 View
10hpelite x2 g4 firmware View
11hpelite x2 g4 View
12hpelite x2 g8 tablet firmware View
13hpelite x2 g8 tablet View
14hpelitebook 1050 g1 firmware View
15hpelitebook 1050 g1 View
16hpelitebook 830 g5 firmware View
17hpelitebook 830 g5 View
18hpelitebook 830 g6 firmware View
19hpelitebook 830 g6 View
20hpelitebook 830 g7 firmware View
21hpelitebook 830 g7 View
22hpelitebook 830 g8 firmware View
23hpelitebook 830 g8 View
24hpelitebook 836 g5 firmware View
25hpelitebook 836 g5 View
26hpelitebook 836 g6 firmware View
27hpelitebook 836 g6 View
28hpelitebook 840 aero g8 firmware View
29hpelitebook 840 aero g8 View
30hpelitebook 840 g5 firmware View
31hpelitebook 840 g5 View
32hpelitebook 840 g5 healthcare edition firmware View
33hpelitebook 840 g5 healthcare edition View
34hpelitebook 840 g6 firmware View
35hpelitebook 840 g6 View
36hpelitebook 840 g6 healthcare edition firmware View
37hpelitebook 840 g6 healthcare edition View
38hpelitebook 840 g7 firmware View
39hpelitebook 840 g7 View
40hpelitebook 840 g8 firmware View
41hpelitebook 840 g8 View
42hpelitebook 840r g4 firmware View
43hpelitebook 840r g4 View
44hpelitebook 846 g5 firmware View
45hpelitebook 846 g5 View
46hpelitebook 850 g5 firmware View
47hpelitebook 850 g5 View
48hpelitebook 850 g6 firmware View
49hpelitebook 850 g6 View
50hpelitebook 850 g7 firmware View
51hpelitebook 850 g7 View
52hpelitebook 850 g8 firmware View
53hpelitebook 850 g8 View
54hpelitebook x360 1030 g3 firmware View
55hpelitebook x360 1030 g3 View
56hpelitebook x360 1030 g4 firmware View
57hpelitebook x360 1030 g4 View
58hpelitebook x360 1030 g7 firmware View
59hpelitebook x360 1030 g7 View
60hpelitebook x360 1030 g8 firmware View
61hpelitebook x360 1030 g8 View
62hpelitebook x360 1040 g5 firmware View
63hpelitebook x360 1040 g5 View
64hpelitebook x360 1040 g6 firmware View
65hpelitebook x360 1040 g6 View
66hpelitebook x360 1040 g7 firmware View
67hpelitebook x360 1040 g7 View
68hpelitebook x360 1040 g8 firmware View
69hpelitebook x360 1040 g8 View
70hpelitebook x360 830 g5 firmware View
71hpelitebook x360 830 g5 View
72hpelitebook x360 830 g6 firmware View
73hpelitebook x360 830 g6 View
74hpelitebook x360 830 g7 firmware View
75hpelitebook x360 830 g7 View
76hpelitebook x360 830 g8 firmware View
77hpelitebook x360 830 g8 View
78hpprobook 430 g5 firmware View
79hpprobook 430 g5 View
80hpprobook 430 g6 firmware View
81hpprobook 430 g6 View
82hpprobook 430 g7 firmware View
83hpprobook 430 g7 View
84hpprobook 430 g8 firmware View
85hpprobook 430 g8 View
86hpprobook 440 g5 firmware View
87hpprobook 440 g5 View
88hpprobook 440 g6 firmware View
89hpprobook 440 g6 View
90hpprobook 440 g7 firmware View
91hpprobook 440 g7 View
92hpprobook 440 g8 firmware View
93hpprobook 440 g8 View
94hpprobook 450 g5 firmware View
95hpprobook 450 g5 View
96hpprobook 450 g6 firmware View
97hpprobook 450 g6 View
98hpprobook 450 g7 firmware View
99hpprobook 450 g7 View
100hpprobook 450 g8 firmware View
101hpprobook 450 g8 View
102hpprobook 470 g5 firmware View
103hpprobook 470 g5 View
104hpprobook 630 g8 firmware View
105hpprobook 630 g8 View
106hpprobook 640 g4 firmware View
107hpprobook 640 g4 View
108hpprobook 640 g5 firmware View
109hpprobook 640 g5 View
110hpprobook 640 g7 firmware View
111hpprobook 640 g7 View
112hpprobook 640 g8 firmware View
113hpprobook 640 g8 View
114hpprobook 650 g4 firmware View
115hpprobook 650 g4 View
116hpprobook 650 g5 firmware View
117hpprobook 650 g5 View
118hpprobook 650 g7 firmware View
119hpprobook 650 g7 View
120hpprobook 650 g8 firmware View
121hpprobook 650 g8 View
122hpprobook x360 11 g3 education edition firmware View
123hpprobook x360 11 g3 education edition View
124hpprobook x360 11 g4 education edition firmware View
125hpprobook x360 11 g4 education edition View
126hpprobook x360 11 g5 education edition firmware View
127hpprobook x360 11 g5 education edition View
128hpprobook x360 11 g6 education edition firmware View
129hpprobook x360 11 g6 education edition View
130hpprobook x360 11 g7 education edition firmware View
131hpprobook x360 11 g7 education edition View
132hpprobook x360 440 g1 firmware View
133hpprobook x360 440 g1 View
134hpzbook 14u g5 firmware View
135hpzbook 14u g5 View
136hpzbook 14u g6 firmware View
137hpzbook 14u g6 View
138hpzbook 15 g5 firmware View
139hpzbook 15 g5 View
140hpzbook 15 g6 firmware View
141hpzbook 15 g6 View
142hpzbook 15u g5 firmware View
143hpzbook 15u g5 View
144hpzbook 15u g6 firmware View
145hpzbook 15u g6 View
146hpzbook 17 g5 firmware View
147hpzbook 17 g5 View
148hpzbook 17 g6 firmware View
149hpzbook 17 g6 View
150hpzbook create g7 firmware View
151hpzbook create g7 View
152hpzbook firefly 14 g7 firmware View
153hpzbook firefly 14 g7 View
154hpzbook firefly 14 g8 firmware View
155hpzbook firefly 14 g8 View
156hpzbook firefly 15 g7 firmware View
157hpzbook firefly 15 g7 View
158hpzbook firefly 15 g8 firmware View
159hpzbook firefly 15 g8 View
160hpzbook fury 15 g7 firmware View
161hpzbook fury 15 g7 View
162hpzbook fury 15 g8 firmware View
163hpzbook fury 15 g8 View
164hpzbook fury 17 g7 firmware View
165hpzbook fury 17 g7 View
166hpzbook fury 17 g8 firmware View
167hpzbook fury 17 g8 View
168hpzbook power 15 g8 firmware View
169hpzbook power 15 g8 View
170hpzbook power g7 firmware View
171hpzbook power g7 View
172hpzbook studio 15 g8 firmware View
173hpzbook studio 15 g8 View
174hpzbook studio g5 firmware View
175hpzbook studio g5 View
176hpzbook studio g7 firmware View
177hpzbook studio g7 View
178hpzbook studio x360 g5 firmware View
179hpzbook studio x360 g5 View
180hpzhan 66 pro 13 g2 firmware View
181hpzhan 66 pro 13 g2 View
182hpzhan 66 pro 14 g2 firmware View
183hpzhan 66 pro 14 g2 View
184hpzhan 66 pro 14 g3 firmware View
185hpzhan 66 pro 14 g3 View
186hpzhan 66 pro 14 g4 firmware View
187hpzhan 66 pro 14 g4 View
188hpzhan 66 pro 15 g2 firmware View
189hpzhan 66 pro 15 g2 View
190hpzhan 66 pro 15 g3 firmware View
191hpzhan 66 pro 15 g3 View
192hpzhan 66 pro g1 firmware View
193hpzhan 66 pro g1 View
194hpzhan x 13 g2 firmware View
195hpzhan x 13 g2 View
196hpz1 entry tower g5 workstation firmware View
197hpz1 entry tower g5 workstation View
198hpz1 entry tower g6 workstation firmware View
199hpz1 entry tower g6 workstation View
200hpz1 g8 tower desktop pc firmware View
Total affected vendors: 2|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
7.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
7.8CVSS V3_1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE ADP
7.2CVSS V2—AV:L/AC:L/Au:N/C:C/I:C/A:CNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-39299 is associated with the following CWEs:

CWE-269: Common Weakness Enumeration Entry CWE-269

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-39299 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsLow
UserGerekmiyor

Official Sources and Advisories

https://support.hp.com/us-en/document/ish_5661066-5661090-16vendor-advisory

CVSS Vector Radar Chart

7.8 / 10
Attack VectorLocalComplexityLowPrivilegesLowUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow privileges
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

N
n/a logo
n/a
H
hp logo
hp

Weakness Type (CWE & CAPEC)

CWE-269

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-39299"