CVE-2017-2751

Severity: medium (CVSS 4.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-03 · updated 2026-06-17
Weakness: CWE-522

Description

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.

Affected products

HP Compaq 14-H000 Firmware: all versions
HP Compaq 14-S000 Firmware: all versions
HP Compaq Cq45-900 Firmware: all versions
Hp 1000-1300 Firmware: before f.48 — fixed in f.48
Hp 14-G000 Firmware: before f.45 — fixed in f.45
Hp 14-R000 Firmware: before f.43 — fixed in f.43
Hp 15-R000 Firmware: before f.43 — fixed in f.43
Hp 15-R500 Firmware: before f.43 — fixed in f.43
Hp 240 G1 Firmware: before f.48 — fixed in f.48
Hp 240 G3 Firmware: before f.43 — fixed in f.43
Hp 245 G1 Firmware: before f.48 — fixed in f.48
Hp 246 Firmware: before f.04 — fixed in f.04
Hp 246 G3 Firmware: before f.43 — fixed in f.43
Hp 250 G1 Notebook Pc Firmware: before f.47 — fixed in f.47
Hp 255 G1 Notebook Pc Firmware: before f.47 — fixed in f.47
Hp 255 G3 Firmware: before f.45 — fixed in f.45
Hp 455 Firmware: before f.08 — fixed in f.08
Hp Envy 100 Firmware: before f.22 — fixed in f.22
Hp Envy 14-K100 Firmware: before f.22 — fixed in f.22
Hp Envy 15-J000 Firmware: before f.22 — fixed in f.22
Hp Envy 15-J100 Firmware: before f.71 — fixed in f.71
Hp Envy 17-J100 Leap Motion Se Firmware: before f.71 — fixed in f.71
Hp Envy 17 J100 Firmware: before f.71 — fixed in f.71
Hp Envy M6-N000 Firmware: before f.26 — fixed in f.26
Hp G14-A000 Firmware: before f.06 — fixed in f.06
Hp Pavilion 10-F000 Firmware: before f.0e — fixed in f.0e
Hp Pavilion 11-N000 Firmware: before f.2e — fixed in f.2e
Hp Pavilion 14-N000 Firmware: before f.72 — fixed in f.72
Hp Pavilion 15-N000 Firmware: before f.72 — fixed in f.72
Hp Pavilion 15-N200 Firmware: before f.72 — fixed in f.72

How to fix

Upgrade to a fixed version: Hp 1000-1300 Firmware f.48; Hp 14-G000 Firmware f.45; Hp 14-R000 Firmware f.43; Hp 15-R000 Firmware f.43; Hp 15-R500 Firmware f.43; Hp 240 G1 Firmware f.48; Hp 240 G3 Firmware f.43; Hp 245 G1 Firmware f.48; Hp 246 Firmware f.04; Hp 246 G3 Firmware f.43; Hp 250 G1 Notebook Pc Firmware f.47; Hp 255 G1 Notebook Pc Firmware f.47. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-2751 or the next vulnerability affects your stack