CVE-2023-26300

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-18 · updated 2026-06-17

Description

A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability.

Affected products

HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: before f.50 — fixed in f.50
HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware: before f.50 — fixed in f.50
HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware: before f.50 — fixed in f.50
HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: before f.50 — fixed in f.50
HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware: before f.50 — fixed in f.50
HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware: before f.50 — fixed in f.50
HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: before f.50 — fixed in f.50
HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware: before f.50 — fixed in f.50
HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware: before f.50 — fixed in f.50
HP 205 G8 24 All-In-One Pc (Rom Family Ssid 8923) Firmware: before f.20 — fixed in f.20
HP 205 G8 24 All-In-One Pc (Rom Family Ssid 8924) Firmware: before f.20 — fixed in f.20
HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware: before f.50 — fixed in f.50
HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware: before f.50 — fixed in f.50
HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware: before f.50 — fixed in f.50
HP 205 Pro G8 24 All-In-One Pc (Rom Family Ssid 8923) Firmware: before f.20 — fixed in f.20
HP 205 Pro G8 24 All-In-One Pc (Rom Family Ssid 8924) Firmware: before f.20 — fixed in f.20
HP 240 G10 Firmware: before f.05 — fixed in f.05
HP 240 G6 Firmware: before f.55 — fixed in f.55
HP 240 G7 Firmware: before f.75 — fixed in f.75
HP 240 G9 Firmware: before f.06 — fixed in f.06
HP 245 Firmware: before f.11 — fixed in f.11
HP 245 G10 Firmware: before f.06 — fixed in f.06
HP 245 G7 Firmware: before f.70 — fixed in f.70
HP 245 G8 Firmware: before f.26 — fixed in f.26
HP 245 G9 Firmware: before f.11 — fixed in f.11
HP 246 G6 Firmware: before f.55 — fixed in f.55
HP 246 G7 Firmware: before f.75 — fixed in f.75
HP 247 G8 Firmware: before f.70 — fixed in f.70
HP 250 G10 Firmware: before f.06 — fixed in f.06
HP 250 G6 Firmware: before f.73 — fixed in f.73

How to fix

Upgrade to a fixed version: HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware f.50; HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware f.50; HP 200 G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware f.50; HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware f.50; HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware f.50; HP 200 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware f.50; HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware f.50; HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F2) Firmware f.50; HP 205 G4 22 All-In-One Pc (Rom Family Ssid 86F3) Firmware f.50; HP 205 G8 24 All-In-One Pc (Rom Family Ssid 8923) Firmware f.20; HP 205 G8 24 All-In-One Pc (Rom Family Ssid 8924) Firmware f.20; HP 205 Pro G4 22 All-In-One Pc (Rom Family Ssid 86F0) Firmware f.50. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26300 or the next vulnerability affects your stack