CVE-2021-39301
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.39% probability · 32th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- hp/z1 entry tower g5 workstation firmware · hp/z1 entry tower g6 workstation firmware · hp/z1 g8 tower desktop pc firmware · hp/z4 g4 workstation \(core-x\) firmware · hp/z4 g4 workstation \(xeon w\) firmware · hp/z6 g4 workstation firmware · hp/z8 g4 workstation firmware · hp/engage flex mini retail system firmware · hp/mp9 g4 retail system firmware · hp/elite dragonfly firmware · hp/elite dragonfly g2 firmware · hp/elite dragonfly max firmware · hp/elite x2 1013 g3 firmware · hp/elite x2 g4 firmware · hp/elite x2 g8 tablet firmware · hp/elitebook 1050 g1 firmware · hp/elitebook 830 g5 firmware · hp/elitebook 830 g6 firmware · hp/elitebook 830 g7 firmware · hp/elitebook 830 g8 firmware · +40 more
- Source
- hp-security-alert@hp.com
EPSS 0.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory
- https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.