CVE-2021-3661

Name: CVE-2021-3661
Creator: NVD / NIST
Published: 2022-12-12T13:15:11.693+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.4/10EPSS 0.30%

Last modified Jun 17, 2026

CVE-2021-3661 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code execution. HP is releasing firmware mitigations for the potential vulnerability.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.

Description

A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code execution. HP is releasing firmware mitigations for the potential vulnerability.

Metrics

CVSS 3.1

8.4/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.30%

22.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Hp	Z1 All-In-One G3 Firmware	01.31
Hp	Z2 Mini G3 Firmware	01.83
Hp	Z2 Mini G4 Firmware	01.08.01
Hp	Z2 Mini G5 Firmware	01.03.00_rev_a
Hp	Z2 Small Form Factor G4 Firmware	01.08.01
Hp	Z2 Small Form Factor G5 Firmware	01.03.00_rev_a
Hp	Z2 Small Form Factor G8 Firmware	01.03.00_rev_a
Hp	Z2 Tower G4 Firmware	01.08.01
Hp	Z2 Tower G5 Firmware	01.03.00_rev_a
Hp	Z2 Tower G8 Firmware	01.03.00_rev_a
Hp	Z238 Microtower Firmware	01.83
Hp	Z240 Small Form Factor Firmware	01.83
Hp	Z240 Tower Firmware	01.83
Hp	Z4 G4 Firmware	02.75
Hp	Z440 Firmware	2.58
Hp	Z6 G4 Firmware	02.75
Hp	Z640 Firmware	2.58
Hp	Z8 G4 Firmware	02.75
Hp	Z840 Firmware	2.58
Hp	Zcentral 4r Firmware	01.18

References

https://support.hp.com/us-en/document/ish_5670997-5671021-16/hpsbhf03770Vendor Advisory
https://support.hp.com/us-en/document/ish_5670997-5671021-16/hpsbhf03770Vendor Advisory

Timeline

Published: Dec 12, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-3661?

How severe is CVE-2021-3661?

CVE-2021-3661 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.30% probability of exploitation in the next 30 days.

How do I fix CVE-2021-3661?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-3661?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST