CVE-2021-39299
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.37% probability · 31th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- hp/elite dragonfly firmware · hp/elite dragonfly g2 firmware · hp/elite dragonfly max firmware · hp/elite x2 1013 g3 firmware · hp/elite x2 g4 firmware · hp/elite x2 g8 tablet firmware · hp/elitebook 1050 g1 firmware · hp/elitebook 830 g5 firmware · hp/elitebook 830 g6 firmware · hp/elitebook 830 g7 firmware · hp/elitebook 830 g8 firmware · hp/elitebook 836 g5 firmware · hp/elitebook 836 g6 firmware · hp/elitebook 840 aero g8 firmware · hp/elitebook 840 g5 firmware · hp/elitebook 840 g5 healthcare edition firmware · hp/elitebook 840 g6 firmware · hp/elitebook 840 g6 healthcare edition firmware · hp/elitebook 840 g7 firmware · hp/elitebook 840 g8 firmware · +40 more
- Source
- hp-security-alert@hp.com
EPSS 0.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory
- https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.