Back to the CVE list
CVE-2021-39300

Improper privilege management in N/a BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT OF SALE SYSTEMS BIOS; WORKSTATIONS BIOS

CVSS score

7.3

EPSS probability

%0.4

Risk score

0.0

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-39300 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-39300 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1n/aBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS View
2hpz1 entry tower g5 workstation firmware View
3hpz1 entry tower g5 workstation View
4hpz1 entry tower g6 workstation firmware View
5hpz1 entry tower g6 workstation View
6hpz1 g8 tower desktop pc firmware View
7hpz1 g8 tower desktop pc View
8hpz4 g4 workstation (core-x) firmware View
9hpz4 g4 workstation (core-x) View
10hpz4 g4 workstation (xeon w) firmware View
11hpz4 g4 workstation (xeon w) View
12hpz6 g4 workstation firmware View
13hpz6 g4 workstation View
14hpz8 g4 workstation firmware View
15hpz8 g4 workstation View
16hpengage flex mini retail system firmware View
17hpengage flex mini retail system View
18hpmp9 g4 retail system firmware View
19hpmp9 g4 retail system View
20hpelite dragonfly firmware View
21hpelite dragonfly View
22hpelite dragonfly g2 firmware View
23hpelite dragonfly g2 View
24hpelite dragonfly max firmware View
25hpelite dragonfly max View
26hpelite x2 1013 g3 firmware View
27hpelite x2 1013 g3 View
28hpelite x2 g4 firmware View
29hpelite x2 g4 View
30hpelite x2 g8 tablet firmware View
31hpelite x2 g8 tablet View
32hpelitebook 1050 g1 firmware View
33hpelitebook 1050 g1 View
34hpelitebook 830 g5 firmware View
35hpelitebook 830 g5 View
36hpelitebook 830 g6 firmware View
37hpelitebook 830 g6 View
38hpelitebook 830 g7 firmware View
39hpelitebook 830 g7 View
40hpelitebook 830 g8 firmware View
41hpelitebook 830 g8 View
42hpelitebook 836 g5 firmware View
43hpelitebook 836 g5 View
44hpelitebook 836 g6 firmware View
45hpelitebook 836 g6 View
46hpelitebook 840 aero g8 firmware View
47hpelitebook 840 aero g8 View
48hpelitebook 840 g5 firmware View
49hpelitebook 840 g5 View
50hpelitebook 840 g5 healthcare edition firmware View
51hpelitebook 840 g5 healthcare edition View
52hpelitebook 840 g6 firmware View
53hpelitebook 840 g6 View
54hpelitebook 840 g6 healthcare edition firmware View
55hpelitebook 840 g6 healthcare edition View
56hpelitebook 840 g7 firmware View
57hpelitebook 840 g7 View
58hpelitebook 840 g8 firmware View
59hpelitebook 840 g8 View
60hpelitebook 840r g4 firmware View
61hpelitebook 840r g4 View
62hpelitebook 846 g5 firmware View
63hpelitebook 846 g5 View
64hpelitebook 850 g5 firmware View
65hpelitebook 850 g5 View
66hpelitebook 850 g6 firmware View
67hpelitebook 850 g6 View
68hpelitebook 850 g7 firmware View
69hpelitebook 850 g7 View
70hpelitebook 850 g8 firmware View
71hpelitebook 850 g8 View
72hpelitebook x360 1030 g3 firmware View
73hpelitebook x360 1030 g3 View
74hpelitebook x360 1030 g4 firmware View
75hpelitebook x360 1030 g4 View
76hpelitebook x360 1030 g7 firmware View
77hpelitebook x360 1030 g7 View
78hpelitebook x360 1030 g8 firmware View
79hpelitebook x360 1030 g8 View
80hpelitebook x360 1040 g5 firmware View
81hpelitebook x360 1040 g5 View
82hpelitebook x360 1040 g6 firmware View
83hpelitebook x360 1040 g6 View
84hpelitebook x360 1040 g7 firmware View
85hpelitebook x360 1040 g7 View
86hpelitebook x360 1040 g8 firmware View
87hpelitebook x360 1040 g8 View
88hpelitebook x360 830 g5 firmware View
89hpelitebook x360 830 g5 View
90hpelitebook x360 830 g6 firmware View
91hpelitebook x360 830 g6 View
92hpelitebook x360 830 g7 firmware View
93hpelitebook x360 830 g7 View
94hpelitebook x360 830 g8 firmware View
95hpelitebook x360 830 g8 View
96hpprobook 430 g5 firmware View
97hpprobook 430 g5 View
98hpprobook 430 g6 firmware View
99hpprobook 430 g6 View
100hpprobook 430 g7 firmware View
101hpprobook 430 g7 View
102hpprobook 430 g8 firmware View
103hpprobook 430 g8 View
104hpprobook 440 g5 firmware View
105hpprobook 440 g5 View
106hpprobook 440 g6 firmware View
107hpprobook 440 g6 View
108hpprobook 440 g7 firmware View
109hpprobook 440 g7 View
110hpprobook 440 g8 firmware View
111hpprobook 440 g8 View
112hpprobook 450 g5 firmware View
113hpprobook 450 g5 View
114hpprobook 450 g6 firmware View
115hpprobook 450 g6 View
116hpprobook 450 g7 firmware View
117hpprobook 450 g7 View
118hpprobook 450 g8 firmware View
119hpprobook 450 g8 View
120hpprobook 470 g5 firmware View
121hpprobook 470 g5 View
122hpprobook 630 g8 firmware View
123hpprobook 630 g8 View
124hpprobook 640 g4 firmware View
125hpprobook 640 g4 View
126hpprobook 640 g5 firmware View
127hpprobook 640 g5 View
128hpprobook 640 g7 firmware View
129hpprobook 640 g7 View
130hpprobook 640 g8 firmware View
131hpprobook 640 g8 View
132hpprobook 650 g4 firmware View
133hpprobook 650 g4 View
134hpprobook 650 g5 firmware View
135hpprobook 650 g5 View
136hpprobook 650 g7 firmware View
137hpprobook 650 g7 View
138hpprobook 650 g8 firmware View
139hpprobook 650 g8 View
140hpprobook x360 11 g3 education edition firmware View
141hpprobook x360 11 g3 education edition View
142hpprobook x360 11 g4 education edition firmware View
143hpprobook x360 11 g4 education edition View
144hpprobook x360 11 g5 education edition firmware View
145hpprobook x360 11 g5 education edition View
146hpprobook x360 11 g6 education edition firmware View
147hpprobook x360 11 g6 education edition View
148hpprobook x360 11 g7 education edition firmware View
149hpprobook x360 11 g7 education edition View
150hpprobook x360 440 g1 firmware View
151hpprobook x360 440 g1 View
152hpzbook 14u g5 firmware View
153hpzbook 14u g5 View
154hpzbook 14u g6 firmware View
155hpzbook 14u g6 View
156hpzbook 15 g5 firmware View
157hpzbook 15 g5 View
158hpzbook 15 g6 firmware View
159hpzbook 15 g6 View
160hpzbook 15u g5 firmware View
161hpzbook 15u g5 View
162hpzbook 15u g6 firmware View
163hpzbook 15u g6 View
164hpzbook 17 g5 firmware View
165hpzbook 17 g5 View
166hpzbook 17 g6 firmware View
167hpzbook 17 g6 View
168hpzbook create g7 firmware View
169hpzbook create g7 View
170hpzbook firefly 14 g7 firmware View
171hpzbook firefly 14 g7 View
172hpzbook firefly 14 g8 firmware View
173hpzbook firefly 14 g8 View
174hpzbook firefly 15 g7 firmware View
175hpzbook firefly 15 g7 View
176hpzbook firefly 15 g8 firmware View
177hpzbook firefly 15 g8 View
178hpzbook fury 15 g7 firmware View
179hpzbook fury 15 g7 View
180hpzbook fury 15 g8 firmware View
181hpzbook fury 15 g8 View
182hpzbook fury 17 g7 firmware View
183hpzbook fury 17 g7 View
184hpzbook fury 17 g8 firmware View
185hpzbook fury 17 g8 View
186hpzbook power 15 g8 firmware View
187hpzbook power 15 g8 View
188hpzbook power g7 firmware View
189hpzbook power g7 View
190hpzbook studio 15 g8 firmware View
191hpzbook studio 15 g8 View
192hpzbook studio g5 firmware View
193hpzbook studio g5 View
194hpzbook studio g7 firmware View
195hpzbook studio g7 View
196hpzbook studio x360 g5 firmware View
197hpzbook studio x360 g5 View
198hpzhan 66 pro 13 g2 firmware View
199hpzhan 66 pro 13 g2 View
200hpzhan 66 pro 14 g2 firmware View
Total affected vendors: 2|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
7.3CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HNVD
7.3CVSS V3_1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVE ADP
7.2CVSS V2—AV:L/AC:L/Au:N/C:C/I:C/A:CNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-39300 is associated with the following CWEs:

CWE-269: Common Weakness Enumeration Entry CWE-269

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-39300 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsLow
UserGerekiyor

Official Sources and Advisories

https://support.hp.com/us-en/document/ish_5661066-5661090-16vendor-advisory

CVSS Vector Radar Chart

7.3 / 10
Attack VectorLocalComplexityLowPrivilegesLowUser Interact.RequiredConfidentialityLowIntegrityHighAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow privileges
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)High
Availability (Erişilebilirlik)High

Yama doğrulandı

1 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

N
n/a logo
n/a
H
hp logo
hp

Weakness Type (CWE & CAPEC)

CWE-269

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-39300"