CVE-2022-27538 json
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow…
published 2023-01-30 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-32039
- cvss
- 7.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
Patch / fix
- hp dragonfly_folio_g3_2-in-1_firmware 01.03.01
- hp elite_dragonfly_firmware 01.22.00
- hp elite_dragonfly_g3_firmware 01.04.00
- hp elite_dragonfly_g2_firmware 01.11.00
- hp elite_dragonfly_max_firmware 01.11.00
- hp elite_x2_1013_g3_firmware 01.22.00
- hp elite_x2_g4_firmware 01.22.00
- hp elite_x2_g8_tablet_firmware 01.11.00
- hp elite_x360_1040_g9_2-in-1_firmware 01.04.02
- hp elitebook_1040_g9_firmware 01.04.02
- hp elitebook_1050_g1_firmware 01.22.00
- hp elitebook_630_g9_firmware 01.05.00
- hp elitebook_640_g9_firmware 01.05.00
- hp elitebook_645_g9_firmware 01.09.00
- hp elitebook_650_g9_firmware 01.05.00
- hp elitebook_655_g9_firmware 01.09.00
- hp elitebook_735_g5_firmware 01.22.00
- hp elitebook_735_g6_firmware 01.22.00
- hp elitebook_745_g5_firmware 01.22.00
- hp elitebook_745_g6_firmware 01.22.00
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- HP Inc. HP PC BIOS
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
support.hp.com
/us-en/document/ish_7387020-7387107-16/hpsbhf03827
patch, vendor-advisory
Sources
- CVE List CVE-2022-27538
- NVD CVE-2022-27538
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.