CVE-2021-3439

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-01 · updated 2026-06-17
Weakness: CWE-269

Description

HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities.

Affected products

HP 200 G3 All-In-One (Rom Family Ssid 8431) Firmware: all versions
HP 200 G3 All-In-One (Rom Family Ssid 84De) Firmware: all versions
HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: all versions
HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F8) Firmware: all versions
HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: all versions
HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F8) Firmware: all versions
HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: all versions
HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F8) Firmware: all versions
HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: all versions
HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F8) Firmware: all versions
HP 218 Pro G5 Microtower Pc Firmware: before f.12 — fixed in f.12
HP 240 G4 Firmware: all versions
HP 240 G5 Firmware: all versions
HP 240 G6 Firmware: before f.50 — fixed in f.50
HP 240 G7 Firmware: before f.64 — fixed in f.64
HP 246 G4 Firmware: all versions
HP 246 G5 Firmware: all versions
HP 246 G6 Firmware: before f.50 — fixed in f.50
HP 246 G7 Firmware: before f.64 — fixed in f.64
HP 250 G4 Firmware: all versions
HP 250 G5 Firmware: before f.51 — fixed in f.51
HP 250 G6 Firmware: before f.68 — fixed in f.68
HP 250 G7 Firmware: before f.38 — fixed in f.38
HP 256 G4 Firmware: all versions
HP 256 G5 Firmware: before f.51 — fixed in f.51
HP 256 G6 Firmware: before f.68 — fixed in f.68
HP 256 G7 Firmware: before f.38 — fixed in f.38
HP 258 G6 Firmware: before f.68 — fixed in f.68
HP 258 G7 Firmware: before f.38 — fixed in f.38
HP 260 G2 Desktop Mini Firmware: all versions

How to fix

Upgrade to a fixed version: HP 218 Pro G5 Microtower Pc Firmware f.12; HP 240 G6 Firmware f.50; HP 240 G7 Firmware f.64; HP 246 G6 Firmware f.50; HP 246 G7 Firmware f.64; HP 250 G5 Firmware f.51; HP 250 G6 Firmware f.68; HP 250 G7 Firmware f.38; HP 256 G5 Firmware f.51; HP 256 G6 Firmware f.68; HP 256 G7 Firmware f.38; HP 258 G6 Firmware f.68. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3439 or the next vulnerability affects your stack