CVE-2022-27541
HIGHCVSS 7.8/10EPSS 0.14%
Last modified
CVE-2022-27541 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
Metrics
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hp | Zcentral 4r Workstation Firmware | <= 1.24 |
| Hp | Z1 All-In-One G3 Workstation Firmware | <= 1.33 |
| Hp | Elitebook 725 G4 Firmware | <= 1.42 |
| Hp | Elitebook 745 G4 Firmware | <= 1.42 |
| Hp | Elitebook 755 G4 Firmware | <= 1.42 |
| Hp | Probook 645 G3 Firmware | <= 1.42 |
| Hp | Probook 655 G3 Firmware | <= 1.42 |
| Hp | Mt43 Mobile Thin Client Firmware | <= 1.42 |
| Hp | Elite X2 1012 G2 Firmware | <= 1.43 |
| Hp | Elitebook 1040 G4 Firmware | <= 1.43 |
| Hp | Elitebook 820 G4 Firmware | <= 1.43 |
| Hp | Elitebook 828 G4 Firmware | <= 1.43 |
| Hp | Elitebook 840 G4 Firmware | <= 1.43 |
| Hp | Elitebook 848 G4 Firmware | <= 1.43 |
| Hp | Elitebook 850 G4 Firmware | <= 1.43 |
| Hp | Elitebook X360 1020 G2 Firmware | <= 1.43 |
| Hp | Elitebook X360 1030 G2 Firmware | <= 1.43 |
| Hp | Pro X2 612 G2 Firmware | <= 1.43 |
| Hp | Probook 455 G4 Firmware | <= 1.43 |
| Hp | Probook 640 G3 Firmware | <= 1.43 |
| Hp | Probook 650 G3 Firmware | <= 1.43 |
| Hp | Zbook 14u G4 Firmware | <= 1.43 |
| Hp | Zbook 15 G4 Firmware | <= 1.43 |
| Hp | Zbook 15u G4 Firmware | <= 1.43 |
| Hp | Zbook 17 G4 Firmware | <= 1.43 |
| Hp | Zbook Studio G4 Firmware | <= 1.43 |
| Hp | Zbook X2 G4 Firmware | <= 1.43 |
| Hp | Probook X360 11 G2 Ee Firmware | <= 1.45 |
| Hp | Elitebook 725 G3 Firmware | <= 1.55 |
| Hp | Elitebook 745 G3 Firmware | <= 1.55 |
| Hp | Elitebook 755 G3 Firmware | <= 1.55 |
| Hp | Probook 455 G3 Firmware | <= 1.55 |
| Hp | Probook 645 G2 Firmware | <= 1.55 |
| Hp | Probook 655 G2 Firmware | <= 1.55 |
| Hp | Elite X2 1012 G1 Firmware | <= 1.57 |
| Hp | Elite X2 1012 G1 Tablet Firmware | <= 1.57 |
| Hp | Elite X2 1012 G1 Tablet With Travel Keyboard Firmware | <= 1.57 |
| Hp | Elitebook 1030 G1 Firmware | <= 1.57 |
| Hp | Elitebook 1040 G3 Firmware | <= 1.57 |
| Hp | Elitebook 820 G3 Firmware | <= 1.57 |
| Hp | Elitebook 828 G3 Firmware | <= 1.57 |
| Hp | Elitebook 840 G3 Firmware | <= 1.57 |
| Hp | Elitebook 848 G3 Firmware | <= 1.57 |
| Hp | Elitebook 850 G3 Firmware | <= 1.57 |
| Hp | Elitebook Folio G1 Firmware | <= 1.57 |
| Hp | Probook 11 Ee G2 Firmware | <= 1.57 |
| Hp | Probook 430 G3 Firmware | <= 1.57 |
| Hp | Probook 440 G3 Firmware | <= 1.57 |
| Hp | Probook 446 G3 Firmware | <= 1.57 |
| Hp | Probook 450 G3 Firmware | <= 1.57 |
Showing 50 of 387 affected configurations. See NVD for the full list.
References
- https://support.hp.com/us-en/document/ish_7709808-7709835-16/hpsbhf03835Broken Link, Vendor Advisory
- https://support.hp.com/us-en/document/ish_7709808-7709835-16/hpsbhf03835Broken Link, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-27541?
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
How severe is CVE-2022-27541?
CVE-2022-27541 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.14% probability of exploitation in the next 30 days.
How do I fix CVE-2022-27541?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-27536Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1…7.5
- CVE-2022-27537Potential vulnerabilities have been identified in the system…7.8
- CVE-2022-27538A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerabil…7
- CVE-2022-27539Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilit…7.8
- CVE-2022-2754The Ketchup Restaurant Reservations WordPress plugin through…9.8
- CVE-2022-27540A potential Time-of-Check to Time-of Use (TOCTOU) vulnerabil…7.8
- CVE-2022-27544BigFix Web Reports authorized users may see SMTP credentials…6.5
- CVE-2022-27545BigFix Web Reports authorized users may perform HTML injecti…5.4
- CVE-2022-27546HCL iNotes is susceptible to a Reflected Cross-site Scriptin…6.1
- CVE-2022-27547HCL iNotes is susceptible to a link to non-existent domain v…7.4
- CVE-2022-27548HCL Launch stores user credentials in plain clear text which…5.5
- CVE-2022-27549HCL Launch may store certain data for recurring activities i…5.5
Are you affected by CVE-2022-27541?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST