Omen Gaming Hub
Monthly
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Local privilege escalation in HP Omen Gaming Hub versions prior to 1101.2603 allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges. A public proof-of-concept detection template exists, but no active exploitation has been reported. The vulnerability is rated High severity with an EPSS of 0.01%, indicating low near-term exploitation probability.
Path traversal in HP System Event Utility and HP Omen Gaming Hub lets a locally positioned low-privileged user make these utilities execute files from outside their intended restricted directories, producing limited confidentiality, integrity and availability impact. The flaw affects HP System Event Utility before version 3.2.12 and Omen Gaming Hub before version 1101.2511.101.0, both of which ship primarily on HP consumer and Omen gaming hardware, so systems without them are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), placing this at medium severity (CVSS 4.0 base 4.8) rather than urgent priority. Exploitation requires local access plus a low-privilege foothold (CVSS vector PR:L) and the ability to place or reference the file the utility will launch; there is no remote attack path.
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Local privilege escalation in HP Omen Gaming Hub versions prior to 1101.2603 allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges. A public proof-of-concept detection template exists, but no active exploitation has been reported. The vulnerability is rated High severity with an EPSS of 0.01%, indicating low near-term exploitation probability.
Path traversal in HP System Event Utility and HP Omen Gaming Hub lets a locally positioned low-privileged user make these utilities execute files from outside their intended restricted directories, producing limited confidentiality, integrity and availability impact. The flaw affects HP System Event Utility before version 3.2.12 and Omen Gaming Hub before version 1101.2511.101.0, both of which ship primarily on HP consumer and Omen gaming hardware, so systems without them are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), placing this at medium severity (CVSS 4.0 base 4.8) rather than urgent priority. Exploitation requires local access plus a low-privilege foothold (CVSS vector PR:L) and the ability to place or reference the file the utility will launch; there is no remote attack path.