CVE-2022-43779
High
Description
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.
SeverityHigh
CVSS7.0
Exploit probability—
ProductHp 348 G4 Firmware
PublishedFeb 12, 2023
First seenFeb 12, 2023
Weakness typeCWE-367CWE-367
How to fix
Update
- hp 348_g4_firmwaref.65 or later
- hp 260_g2_desktop_mini_firmware2.26 or later
- hp 218_pro_g5_mt_firmwaref15 or later
- hp 260_g3_desktop_mini_firmware02.20.00 or later
- hp 260_g4_desktop_mini_firmware02.12.00 or later
- hp 280_g3_microtower_pc_firmware02.02.40 or later
- hp 280_g3_pci_microtower_pc_firmware02.02.40 or later
- hp 288_pro_g3_microtower_pc_firmware00.02.40 or later
- hp 290_g1_microtower_firmware00.02.40 or later
- hp desktop_pro_300_g3_firmwaref15 or later
- hp desktop_pro_a_300_g3_firmwaref12 or later
- hp desktop_pro_a_g2_firmwaref.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hp 348_g4_firmware | v < f.65 | f.65 |
| hp 260_g2_desktop_mini_firmware | v < 2.26 | 2.26 |
| hp 218_pro_g5_mt_firmware | v < f15 | f15 |
| hp 260_g3_desktop_mini_firmware | v < 02.20.00 | 02.20.00 |
| hp 260_g4_desktop_mini_firmware | v < 02.12.00 | 02.12.00 |
| hp 280_g3_microtower_pc_firmware | v < 02.02.40 | 02.02.40 |
| hp 280_g3_pci_microtower_pc_firmware | v < 02.02.40 | 02.02.40 |
| hp 288_pro_g3_microtower_pc_firmware | v < 00.02.40 | 00.02.40 |
| hp 290_g1_microtower_firmware | v < 00.02.40 | 00.02.40 |
| hp desktop_pro_300_g3_firmware | v < f15 | f15 |
| hp desktop_pro_a_300_g3_firmware | v < f12 | f12 |
| hp desktop_pro_a_g2_firmware | v < f.11 | f.11 |
| hp desktop_pro_a_g2_microtower_firmware | v < f.11 | f.11 |
| hp desktop_pro_a_g3_firmware | v < f12 | f12 |
| hp desktop_pro_a_g3_microtower_firmware | v < f12 | f12 |
| hp desktop_pro_g3_firmware | v < f15 | f15 |
| hp desktop_pro_g3_microtower_firmware | v < f15 | f15 |
| hp desktop_pro_microtower_firmware | v < 00.02.40 | 00.02.40 |
| hp zhan_66_pro_a_g1_microtower_firmware | v < f.11 | f.11 |
| hp zhan_66_pro_a_g1_r_microtower_firmware | v < f12 | f12 |
| hp zhan_66_pro_g1_r_microtower_firmware | v < f15 | f15 |
| hp zhan_86_pro_g1_microtower_firmware | v < 00.02.40 | 00.02.40 |
| hp rp2_retail_system_2000_firmware | v < 2.24 | 2.24 |
| hp rp2_retail_system_2020_firmware | v < 2.24 | 2.24 |
| hp rp2_retail_system_2030_firmware | v < 2.24 | 2.24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.