What’s Vulnerable › Vulnerabilities

CVE-2022-37019: HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-10 · updated 2026-06-17
• Weakness: CWE-269

Description

Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.

Affected products

• HP Elite Slice Firmware: before 00.02.64 — fixed in 00.02.64
• HP Elite Slice For Meeting Rooms Firmware: before 00.02.64 — fixed in 00.02.64
• HP Elitebook 1040 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook 820 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook 828 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook 840 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook 848 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook 850 G3 Firmware: before 01.62 — fixed in 01.62
• HP Elitebook Folio G1 Firmware: before 01.62 — fixed in 01.62
• HP Elitedesk 800 35W G2 Desktop Mini Pc Firmware: before 00.02.63 — fixed in 00.02.63
• HP Elitedesk 800 65W G2 Desktop Mini Pc Firmware: before 00.02.63 — fixed in 00.02.63
• HP Mp9 G2 Retail System Firmware: before 02.63 — fixed in 02.63
• HP Probook 440 G3 Firmware: before 1.62 — fixed in 1.62
• HP Probook 446 G3 Firmware: before 1.62 — fixed in 1.62
• HP Probook 470 G3 Firmware: before 1.62 — fixed in 1.62
• HP Probook 640 G2 Firmware: before 1.62 — fixed in 1.62
• HP Probook 650 G2 Firmware: before 1.62 — fixed in 1.62
• HP Rp9 G1 Retail System Firmware: before 02.64 — fixed in 02.64
• HP Z238 Microtower Workstation Firmware: before 01.91 — fixed in 01.91
• HP Z240 Small Form Factor Workstation Firmware: before 01.91 — fixed in 01.91
• HP Z240 Tower Workstation Firmware: before 01.91 — fixed in 01.91
• HP Z2 Mini G3 Workstation Firmware: before 01.91 — fixed in 01.91
• HP Zbook 15 G3 Firmware: before 1.62 — fixed in 1.62
• HP Zbook 15U G3 Firmware: before 1.62 — fixed in 1.62
• HP Zbook 17 G3 Firmware: before 1.62 — fixed in 1.62
• HP Zbook Studio G3 Firmware: before 1.62 — fixed in 1.62

How to fix

Upgrade to a fixed version: HP Elite Slice Firmware 00.02.64; HP Elite Slice For Meeting Rooms Firmware 00.02.64; HP Elitebook 1040 G3 Firmware 01.62; HP Elitebook 820 G3 Firmware 01.62; HP Elitebook 828 G3 Firmware 01.62; HP Elitebook 840 G3 Firmware 01.62; HP Elitebook 848 G3 Firmware 01.62; HP Elitebook 850 G3 Firmware 01.62; HP Elitebook Folio G1 Firmware 01.62; HP Elitedesk 800 35W G2 Desktop Mini Pc Firmware 00.02.63; HP Elitedesk 800 65W G2 Desktop Mini Pc Firmware 00.02.63; HP Mp9 G2 Retail System Firmware 02.63. Check the vendor advisory for mitigations.

References

• https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943
• https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943

Get alerted when CVE-2022-37019 or the next vulnerability affects your stack