CVE-2022-37018

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-12 · updated 2026-06-17
Weakness: CWE-276

Description

A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerability.

Affected products

HP Elite Slice Firmware: before 02.59 — fixed in 02.59
HP Elite X2 1012 G1 Firmware: before 01.58 — fixed in 01.58
HP Elite X2 1012 G2 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 1030 G1 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 1040 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 1040 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 820 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 820 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 828 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 828 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 840 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 840 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 848 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 848 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook 850 G3 Firmware: before 01.58 — fixed in 01.58
HP Elitebook 850 G4 Firmware: before 01.44 — fixed in 01.44
HP Elitebook Folio G1 Firmware: before 01.58 — fixed in 01.58
HP Elitebook X360 1020 G2 Firmware: before 01.44 — fixed in 01.44
HP Elitebook X360 1030 G2 Firmware: before 01.44 — fixed in 01.44
HP Elitedesk 800 35W G2 Desktop Mini Pc Firmware: before 02.59 — fixed in 02.59
HP Elitedesk 800 35W G3 Desktop Mini Pc Firmware: before 02.44 — fixed in 02.44
HP Elitedesk 800 65W G2 Desktop Mini Pc Firmware: before 02.59 — fixed in 02.59
HP Elitedesk 800 65W G3 Desktop Mini Pc Firmware: before 02.44 — fixed in 02.44
HP Elitedesk 800 G2 Sff Firmware: before 02.59 — fixed in 02.59
HP Eliteone 800 G2 Aio Firmware: before 02.59 — fixed in 02.59
HP Eliteone 800 G3 Firmware: before 02.44 — fixed in 02.44
HP Engage One Aio System Firmware: before 02.44 — fixed in 02.44
HP Mp9 G2 Retail System Firmware: before 02.59 — fixed in 02.59
HP Pro X2 612 G2 Firmware: before 01.44 — fixed in 01.44
HP Probook 11 G2 Firmware: before 01.58 — fixed in 01.58

How to fix

Upgrade to a fixed version: HP Elite Slice Firmware 02.59; HP Elite X2 1012 G1 Firmware 01.58; HP Elite X2 1012 G2 Firmware 01.44; HP Elitebook 1030 G1 Firmware 01.58; HP Elitebook 1040 G3 Firmware 01.58; HP Elitebook 1040 G4 Firmware 01.44; HP Elitebook 820 G3 Firmware 01.58; HP Elitebook 820 G4 Firmware 01.44; HP Elitebook 828 G3 Firmware 01.58; HP Elitebook 828 G4 Firmware 01.44; HP Elitebook 840 G3 Firmware 01.58; HP Elitebook 840 G4 Firmware 01.44. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-37018 or the next vulnerability affects your stack