CVE-2023-26299

2023-06-3015:40:10

www.cve.org

cve-2023-26299

arbitrary code execution

ami uefi firmware

bios

hp pc products

vulnerability

mitigation

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

CNA Affected

[
  {
    "versions": [
      {
        "version": "See HP Security Bulletin reference for affected versions.",
        "status": "affected"
      }
    ],
    "product": "HP PC products using AMI UEFI Firmware",
    "vendor": "HP Inc."
  }
]

References

support.hp.com/us-en/document/ish_8642715-8642746-16/hpsbhf03850