What’s Vulnerable › Vulnerabilities

CVE-2022-43779

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-12 · updated 2026-06-17
• Weakness: CWE-367

Description

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.

Affected products

• HP 218 Pro G5 Mt Firmware: before f15 — fixed in f15
• HP 260 G2 Desktop Mini Firmware: before 2.26 — fixed in 2.26
• HP 260 G3 Desktop Mini Firmware: before 02.20.00 — fixed in 02.20.00
• HP 260 G4 Desktop Mini Firmware: before 02.12.00 — fixed in 02.12.00
• HP 280 G3 Microtower Pc Firmware: before 02.02.40 — fixed in 02.02.40
• HP 280 G3 Pci Microtower Pc Firmware: before 02.02.40 — fixed in 02.02.40
• HP 288 Pro G3 Microtower Pc Firmware: before 00.02.40 — fixed in 00.02.40
• HP 290 G1 Microtower Firmware: before 00.02.40 — fixed in 00.02.40
• HP 348 G4 Firmware: before f.65 — fixed in f.65
• HP Desktop Pro 300 G3 Firmware: before f15 — fixed in f15
• HP Desktop Pro A 300 G3 Firmware: before f12 — fixed in f12
• HP Desktop Pro A G2 Firmware: before f.11 — fixed in f.11
• HP Desktop Pro A G2 Microtower Firmware: before f.11 — fixed in f.11
• HP Desktop Pro A G3 Firmware: before f12 — fixed in f12
• HP Desktop Pro A G3 Microtower Firmware: before f12 — fixed in f12
• HP Desktop Pro G3 Firmware: before f15 — fixed in f15
• HP Desktop Pro G3 Microtower Firmware: before f15 — fixed in f15
• HP Desktop Pro Microtower Firmware: before 00.02.40 — fixed in 00.02.40
• HP Rp2 Retail System 2000 Firmware: before 2.24 — fixed in 2.24
• HP Rp2 Retail System 2020 Firmware: before 2.24 — fixed in 2.24
• HP Rp2 Retail System 2030 Firmware: before 2.24 — fixed in 2.24
• HP Zhan 66 Pro A G1 Microtower Firmware: before f.11 — fixed in f.11
• HP Zhan 66 Pro A G1 R Microtower Firmware: before f12 — fixed in f12
• HP Zhan 66 Pro G1 R Microtower Firmware: before f15 — fixed in f15
• HP Zhan 86 Pro G1 Microtower Firmware: before 00.02.40 — fixed in 00.02.40

How to fix

Upgrade to a fixed version: HP 218 Pro G5 Mt Firmware f15; HP 260 G2 Desktop Mini Firmware 2.26; HP 260 G3 Desktop Mini Firmware 02.20.00; HP 260 G4 Desktop Mini Firmware 02.12.00; HP 280 G3 Microtower Pc Firmware 02.02.40; HP 280 G3 Pci Microtower Pc Firmware 02.02.40; HP 288 Pro G3 Microtower Pc Firmware 00.02.40; HP 290 G1 Microtower Firmware 00.02.40; HP 348 G4 Firmware f.65; HP Desktop Pro 300 G3 Firmware f15; HP Desktop Pro A 300 G3 Firmware f12; HP Desktop Pro A G2 Firmware f.11. Check the vendor advisory for mitigations.

References

• https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829
• https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829

Get alerted when CVE-2022-43779 or the next vulnerability affects your stack