CVE-2019-18913

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-31 · updated 2026-06-17

Description

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

Affected products

HP Elite Dragonfly Firmware: before 01.04.02 — fixed in 01.04.02
HP Elite X2 G4 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 830 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 836 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 840 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 840 G6 Healthcare Edition Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 846 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 846 G6 Healthcare Edition Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook 850 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook X360 1030 G4 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook X360 1040 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitebook X360 830 G6 Firmware: before 01.04.02 — fixed in 01.04.02
HP Elitedesk 800 G5 Dm Firmware: before 02.04.02 — fixed in 02.04.02
HP Elitedesk 800 G5 Sff Firmware: before 02.04.02 — fixed in 02.04.02
HP Elitedesk 800 G5 Twr Firmware: before 02.04.02 — fixed in 02.04.02
HP Eliteone 800 G5 Aio Firmware: before 02.04.02 — fixed in 02.04.02
HP Probook 640 G5 Firmware: before 01.04.02 — fixed in 01.04.02
HP Probook 650 G5 Firmware: before 01.04.02 — fixed in 01.04.02
HP Prodesk 400 G5 Dm Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 400 G6 Mt Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 400 G6 Sff Firmware: before 02.04.02 — fixed in 02.04.02
HP Prodesk 480 G6 Mt Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 600 G5 Dm Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 600 G5 Mt Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 600 G5 Pci Mt Firmware: before 02.04.01 — fixed in 02.04.01
HP Prodesk 600 G5 Sff Firmware: before 02.04.01 — fixed in 02.04.01
HP Proone 400 G5 Aio Firmware: before 02.04.01 — fixed in 02.04.01
HP Proone 440 G5 Aio Firmware: before 02.04.01 — fixed in 02.04.01
HP Proone 600 G5 Aio Firmware: before 02.04.01 — fixed in 02.04.01
HP Zbook 14U G6 Mobile Workstation Firmware: before 01.04.02 — fixed in 01.04.02

How to fix

Upgrade to a fixed version: HP Elite Dragonfly Firmware 01.04.02; HP Elite X2 G4 Firmware 01.04.02; HP Elitebook 830 G6 Firmware 01.04.02; HP Elitebook 836 G6 Firmware 01.04.02; HP Elitebook 840 G6 Firmware 01.04.02; HP Elitebook 840 G6 Healthcare Edition Firmware 01.04.02; HP Elitebook 846 G6 Firmware 01.04.02; HP Elitebook 846 G6 Healthcare Edition Firmware 01.04.02; HP Elitebook 850 G6 Firmware 01.04.02; HP Elitebook X360 1030 G4 Firmware 01.04.02; HP Elitebook X360 1040 G6 Firmware 01.04.02; HP Elitebook X360 830 G6 Firmware 01.04.02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-18913 or the next vulnerability affects your stack