What is the CVSS score of CVE-2023-26299?

CVE-2023-26299 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2023-26299?

Yes, a patch is available for CVE-2023-26299. Update the affected software to the latest version immediately.

260 G4 Desktop Mini Firmware CVE-2023-26299

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2023-06-30 hp-security-alert@hp.com

RCE HP 260 G4 Desktop Mini Firmware T430 Firmware T628 Firmware 240 G10 Firmware 245 G6 Firmware 245 G7 Firmware 245 G8 Firmware 247 G8 Firmware 250 G10 Firmware 255 G10 Firmware 349 G7 Firmware 470 G10 Firmware 470 G9 Firmware Zhan 99 G2 Firmware Zhan 99 G4 Firmware Vr Backpack G2 Firmware 200 G3 Firmware 200 G4 22 All In One Firmware 200 Pro G4 22 All In One Firmware 205 G4 22 All In One Firmware 205 Pro G4 22 All In One Firmware 280 G3 Firmware 280 G4 Firmware 280 G4 Microtower Firmware 280 G5 Firmware 280 G5 Small Form Factor Firmware 280 G6 Firmware 280 G8 Microtower Firmware 280 Pro G3 Firmware 280 Pro G4 Microtower Firmware 280 Pro G5 Small Form Factor Firmware 282 G5 Firmware 282 G6 Firmware 282 Pro G4 Microtower Firmware 288 G5 Firmware 288 G6 Firmware 288 Pro G4 Microtower Firmware 290 G1 Firmware 290 G2 Firmware 290 G2 Microtower Firmware 290 G3 Firmware 290 G3 Small Form Factor Firmware 290 G4 Firmware Desktop Pro G1 Microtower Firmware Pro Small Form Factor 280 G9 Desktop Firmware Pro Small Form Factor 290 G9 Desktop Firmware Pro Small Form Factor Zhan 66 G9 Desktop Firmware Pro Tower 200 G9 Desktop Firmware Pro Tower 280 G9 Desktop Firmware Pro Tower 290 G9 Desktop Firmware Pro Tower Zhan 99 G9 Desktop Firmware Proone 240 G10 Firmware Proone 240 G9 Firmware Proone 440 G3 Firmware Proone 490 G3 Firmware Proone 496 G3 Firmware Z Vr Backpack G1 Workstation Firmware Zhan 86 Pro G2 Microtower Firmware Zhan 99 Pro G1 Microtower Firmware

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 30, 2023 - 16:15 nvd

HIGH 7.0

DescriptionNVD

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-367. A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability. Affected products include: Hp 260 G4 Desktop Mini Firmware, Hp T430 Firmware, Hp T628 Firmware, Hp 240 G10 Firmware, Hp 245 G6 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.