What’s Vulnerable › Vulnerabilities

CVE-2023-26299

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-30 · updated 2026-06-17
• Weakness: CWE-367

Description

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

Affected products

• HP 200 G3 Firmware: all versions
• HP 200 G4 22 All-In-One Firmware: all versions
• HP 200 Pro G4 22 All-In-One Firmware: all versions
• HP 205 G4 22 All-In-One Firmware: all versions
• HP 205 Pro G4 22 All-In-One Firmware: all versions
• HP 240 G10 Firmware: before f.04 — fixed in f.04
• HP 245 G6 Firmware: before f.35 — fixed in f.35
• HP 245 G7 Firmware: before f.69 — fixed in f.69
• HP 245 G8 Firmware: before f.25 — fixed in f.25
• HP 247 G8 Firmware: before f.69 — fixed in f.69
• HP 250 G10 Firmware: before f.05 — fixed in f.05
• HP 255 G10 Firmware: before f.08 — fixed in f.08
• HP 260 G4 Desktop Mini Firmware: before 2.14 — fixed in 2.14
• HP 280 G3 Firmware: all versions
• HP 280 G4 Firmware: all versions
• HP 280 G4 Microtower Firmware: all versions
• HP 280 G5 Firmware: all versions
• HP 280 G5 Small Form Factor Firmware: all versions
• HP 280 G6 Firmware: all versions
• HP 280 G8 Microtower Firmware: all versions
• HP 280 Pro G3 Firmware: all versions
• HP 280 Pro G4 Microtower Firmware: all versions
• HP 280 Pro G5 Small Form Factor Firmware: all versions
• HP 282 G5 Firmware: all versions
• HP 282 G6 Firmware: all versions
• HP 282 Pro G4 Microtower Firmware: all versions
• HP 288 G5 Firmware: all versions
• HP 288 G6 Firmware: all versions
• HP 288 Pro G4 Microtower Firmware: all versions
• HP 290 G1 Firmware: all versions

How to fix

Upgrade to a fixed version: HP 240 G10 Firmware f.04; HP 245 G6 Firmware f.35; HP 245 G7 Firmware f.69; HP 245 G8 Firmware f.25; HP 247 G8 Firmware f.69; HP 250 G10 Firmware f.05; HP 255 G10 Firmware f.08; HP 260 G4 Desktop Mini Firmware 2.14; HP 349 G7 Firmware f.28; HP 470 G10 Firmware f.02; HP 470 G9 Firmware f.05; HP T430 Firmware 00.01.11. Check the vendor advisory for mitigations.

References

• https://support.hp.com/us-en/document/ish_8642715-8642746-16/hpsbhf03850
• https://support.hp.com/us-en/document/ish_8642715-8642746-16/hpsbhf03850

Get alerted when CVE-2023-26299 or the next vulnerability affects your stack