CVE-2022-43779 json
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (syst…
published 2023-02-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-46749
- cvss
- 7.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.
Patch / fix
- hp 348_g4_firmware f.65
- hp 260_g2_desktop_mini_firmware 2.26
- hp 218_pro_g5_mt_firmware f15
- hp 260_g3_desktop_mini_firmware 02.20.00
- hp 260_g4_desktop_mini_firmware 02.12.00
- hp 280_g3_microtower_pc_firmware 02.02.40
- hp 280_g3_pci_microtower_pc_firmware 02.02.40
- hp 288_pro_g3_microtower_pc_firmware 00.02.40
- hp 290_g1_microtower_firmware 00.02.40
- hp desktop_pro_300_g3_firmware f15
- hp desktop_pro_a_300_g3_firmware f12
- hp desktop_pro_a_g2_firmware f.11
- hp desktop_pro_a_g2_microtower_firmware f.11
- hp desktop_pro_a_g3_firmware f12
- hp desktop_pro_a_g3_microtower_firmware f12
- hp desktop_pro_g3_firmware f15
- hp desktop_pro_g3_microtower_firmware f15
- hp desktop_pro_microtower_firmware 00.02.40
- hp zhan_66_pro_a_g1_microtower_firmware f.11
- hp zhan_66_pro_a_g1_r_microtower_firmware f12
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- HP Inc. HP PC products using AMI UEFI Firmware
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
support.hp.com
/us-en/document/ish_7394557-7394585-16/hpsbhf03829
patch, vendor-advisory
Sources
- CVE List CVE-2022-43779
- NVD CVE-2022-43779
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.