{"id":"CVE-2021-39297","title":"Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.","summary":"Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-269"],"vendor":"hp","product":"260_g3_desktop_mini_pc_firmware","affected":["260_g3_desktop_mini_pc_firmware <= 2.17.00","elitedesk_800_35w_g4_desktop_mini_pc_firmware <= 2.18.00","elitedesk_800_65w_g4_desktop_mini_pc_firmware <= 2.18.00","elitedesk_800_95w_g4_desktop_mini_pc_firmware <= 2.18.00","elitedesk_800_g4_small_form_factor_pc_firmware <= 2.18.00","elitedesk_800_g4_tower_pc_firmware <= 2.18.00","elitedesk_800_g4_workstation_edition_firmware <= 2.18.00","elitedesk_800_g5_desktop_mini_pc_firmware <= 2.12.00","elitedesk_800_g5_small_form_factor_pc_firmware <= 2.12.00","elitedesk_800_g5_tower_pc_firmware <= 2.12.00","elitedesk_800_g6_desktop_mini_pc_firmware <= 2.10.00","elitedesk_800_g6_small_form_factor_pc_firmware <= 2.10.00","elitedesk_800_g6_tower_pc_firmware <= 2.10.00","elitedesk_800_g8_desktop_mini_pc_firmware <= 2.07.00","elitedesk_800_g8_small_form_factor_pc_firmware <= 2.07.00","elitedesk_800_g8_tower_pc_firmware <= 2.07.00","elitedesk_805_g6_desktop_mini_pc_firmware <= 2.07.00","elitedesk_805_g6_small_form_factor_pc_firmware <= 2.07.00","elitedesk_805_g8_desktop_mini_pc_firmware <= 2.03.00","elitedesk_805_g8_small_form_factor_pc_firmware <= 2.03.00","elitedesk_880_g4_tower_pc_firmware <= 2.18.00","elitedesk_880_g5_tower_pc_firmware <= 2.12.00","elitedesk_880_g6_tower_pc_firmware <= 2.10.00","elitedesk_880_g8_tower_pc_firmware <= 2.07.00","eliteone_1000_g2_23.8-in_all-in-one_business_pc_firmware <= 2.18.00","eliteone_1000_g2_23.8-in_touch_all-in-one_business_pc_firmware <= 2.18.00","eliteone_1000_g2_27-in_4k_uhd_all-in-one_business_pc_firmware <= 2.18.00","eliteone_1000_g2_34-in_curved_all-in-one_business_pc_firmware <= 2.18.00","eliteone_800_g4_23.8-in_healthcare_edition_all-in-one_business_pc_firmware <= 2.18.00","eliteone_800_g4_23.8-inch_non-touch_all-in-one_pc_firmware <= 2.18.00","eliteone_800_g4_23.8-inch_non-touch_gpu_all-in-one_pc_firmware <= 2.18.00","eliteone_800_g4_23.8-inch_touch_all-in-one_pc_firmware <= 2.18.00","eliteone_800_g4_23.8-inch_touch_gpu_all-in-one_pc_firmware <= 2.18.00","eliteone_800_g5_23.8-in_healthcare_edition_all-in-one_firmware <= 2.12.00","eliteone_800_g5_23.8-inch_all-in-one_firmware <= 2.12.00","eliteone_800_g6_24_all-in-one_pc_firmware <= 2.10.00","eliteone_800_g6_27_all-in-one_pc_firmware <= 2.10.00","eliteone_800_g8_24_all-in-one_pc_firmware <= 2.07.00","eliteone_800_g8_27_all-in-one_pc_firmware <= 2.07.00","prodesk_400_g4_desktop_mini_pc_firmware <= 2.18.00","prodesk_400_g5_desktop_mini_pc_firmware <= 2.12.00","prodesk_400_g5_microtower_pc_firmware <= 2.18.00","prodesk_400_g5_small_form_factor_pc_firmware <= 2.18.00","prodesk_400_g6_desktop_mini_pc_firmware <= 2.10.00","prodesk_400_g6_microtower_pc_firmware <= 2.12.00","prodesk_400_g6_small_form_factor_pc_firmware <= 2.12.00","prodesk_400_g7_microtower_pc_firmware <= 2.10.00","prodesk_400_g7_small_form_factor_pc_firmware <= 2.10.00","prodesk_405_g8_desktop_mini_pc_firmware <= 2.03.00","prodesk_405_g8_small_form_factor_pc_firmware <= 2.03.00","prodesk_480_g5_microtower_pc_firmware <= 2.18.00","prodesk_480_g6_microtower_pc_firmware <= 2.12.00","prodesk_480_g7_pci_microtower_pc_firmware <= 2.10.00","prodesk_600_g4_desktop_mini_pc_firmware <= 2.18.00","prodesk_600_g4_microtower_pc_firmware <= 2.18.00","prodesk_600_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00","prodesk_600_g4_small_form_factor_pc_firmware <= 2.18.00","prodesk_600_g5_desktop_mini_pc_firmware <= 2.12.00","prodesk_600_g5_microtower_pc_firmware <= 2.12.00","prodesk_600_g5_microtower_pc(with_pci_slot)_firmware <= 2.12.00","prodesk_600_g5_small_form_factor_pc_firmware <= 2.12.00","prodesk_600_g6_desktop_mini_pc_firmware <= 2.10.00","prodesk_600_g6_microtower_pc_firmware <= 2.10.00","prodesk_600_g6_small_form_factor_pc_firmware <= 2.10.00","prodesk_680_g4_microtower_pc_firmware <= 2.18.00","prodesk_680_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00","prodesk_680_g6_pci_microtower_pc_firmware <= 2.10.00","proone_400_g4_20-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00","proone_400_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00","proone_400_g5_20-inch_all-in-one_business_pc_firmware <= 2.12.00","proone_400_g5_23.8-inch_all-in-one_business_pc_firmware <= 2.12.00","proone_400_g6_20_all-in-one_pc_firmware <= 2.10.00","proone_400_g6_24_all-in-one_pc_firmware <= 2.10.00","proone_440_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00","proone_440_g5_23.8-in_all-in-one_business_pc_firmware <= 2.12.00","proone_440_g6_24_all-in-one_pc_firmware <= 2.10.00","proone_600_g4_21.5-inch_touch_all-in-one_business_pc_firmware <= 2.18.00","proone_600_g5_21.5-in_all-in-one_business_pc_firmware <= 2.12.00","proone_600_g6_22_all-in-one_pc_firmware <= 2.10.00","zhan_66_pro_g3_22_all-in-one_pc_firmware <= 2.10.00","zhan_66_pro_g3_24_all-in-one_pc_firmware <= 2.10.00","z1_entry_tower_g5_workstation_firmware < 02.12.00","z1_entry_tower_g6_workstation_firmware < 02.10.00","z1_g8_tower_desktop_pc_firmware < 02.07.00","z4_g4_workstation_(core-x)_firmware < 02.75","z4_g4_workstation_(xeon_w)_firmware < 02.75","z6_g4_workstation_firmware < 02.75","z8_g4_workstation_firmware < 02.75","engage_flex_mini_retail_system_firmware < 02.10.00","mp9_g4_retail_system_firmware < 02.18.00","elite_dragonfly_firmware < 01.12.00","elite_dragonfly_g2_firmware < 01.08.00","elite_dragonfly_max_firmware < 01.08.00","elite_x2_1013_g3_firmware < 01.19.00","elite_x2_g4_firmware < 01.12.00","elite_x2_g8_tablet_firmware < 01.08.00","elitebook_1050_g1_firmware < 01.19.00","elitebook_830_g5_firmware < 01.19.00","elitebook_830_g6_firmware < 01.12.00","elitebook_830_g7_firmware < 01.08.00"],"patched":["z1_entry_tower_g5_workstation_firmware 02.12.00","z1_entry_tower_g6_workstation_firmware 02.10.00","z1_g8_tower_desktop_pc_firmware 02.07.00","z4_g4_workstation_(core-x)_firmware 02.75","z4_g4_workstation_(xeon_w)_firmware 02.75","z6_g4_workstation_firmware 02.75","z8_g4_workstation_firmware 02.75","engage_flex_mini_retail_system_firmware 02.10.00","mp9_g4_retail_system_firmware 02.18.00","elite_dragonfly_firmware 01.12.00","elite_dragonfly_g2_firmware 01.08.00","elite_dragonfly_max_firmware 01.08.00","elite_x2_1013_g3_firmware 01.19.00","elite_x2_g4_firmware 01.12.00","elite_x2_g8_tablet_firmware 01.08.00","elitebook_1050_g1_firmware 01.19.00","elitebook_830_g5_firmware 01.19.00","elitebook_830_g6_firmware 01.12.00","elitebook_830_g7_firmware 01.08.00"],"published":"2022-02-16","updated":"2026-10-07","sourceUpdated":"2026-10-07T19:17:28.350","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-39297","references":[{"url":"https://support.hp.com/us-en/document/ish_5661066-5661090-16","label":"hp-security-alert@hp.com"},{"url":"https://support.hp.com/us-en/document/ish_5661066-5661090-16","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00441,"epssPercentile":0.36176,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-07T18:09:34.194302Z"},"scores":{"nvd":8.8,"adp":7.8},"ingestedAt":"2026-10-07T18:42:20.904Z","slug":"CVE-2021-39297","body":"## Overview\n\nPotential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.\n\n## Affected\n\n- `260_g3_desktop_mini_pc_firmware <= 2.17.00`\n- `elitedesk_800_35w_g4_desktop_mini_pc_firmware <= 2.18.00`\n- `elitedesk_800_65w_g4_desktop_mini_pc_firmware <= 2.18.00`\n- `elitedesk_800_95w_g4_desktop_mini_pc_firmware <= 2.18.00`\n- `elitedesk_800_g4_small_form_factor_pc_firmware <= 2.18.00`\n- `elitedesk_800_g4_tower_pc_firmware <= 2.18.00`\n- `elitedesk_800_g4_workstation_edition_firmware <= 2.18.00`\n- `elitedesk_800_g5_desktop_mini_pc_firmware <= 2.12.00`\n- `elitedesk_800_g5_small_form_factor_pc_firmware <= 2.12.00`\n- `elitedesk_800_g5_tower_pc_firmware <= 2.12.00`\n- `elitedesk_800_g6_desktop_mini_pc_firmware <= 2.10.00`\n- `elitedesk_800_g6_small_form_factor_pc_firmware <= 2.10.00`\n- `elitedesk_800_g6_tower_pc_firmware <= 2.10.00`\n- `elitedesk_800_g8_desktop_mini_pc_firmware <= 2.07.00`\n- `elitedesk_800_g8_small_form_factor_pc_firmware <= 2.07.00`\n- `elitedesk_800_g8_tower_pc_firmware <= 2.07.00`\n- `elitedesk_805_g6_desktop_mini_pc_firmware <= 2.07.00`\n- `elitedesk_805_g6_small_form_factor_pc_firmware <= 2.07.00`\n- `elitedesk_805_g8_desktop_mini_pc_firmware <= 2.03.00`\n- `elitedesk_805_g8_small_form_factor_pc_firmware <= 2.03.00`\n- `elitedesk_880_g4_tower_pc_firmware <= 2.18.00`\n- `elitedesk_880_g5_tower_pc_firmware <= 2.12.00`\n- `elitedesk_880_g6_tower_pc_firmware <= 2.10.00`\n- `elitedesk_880_g8_tower_pc_firmware <= 2.07.00`\n- `eliteone_1000_g2_23.8-in_all-in-one_business_pc_firmware <= 2.18.00`\n- `eliteone_1000_g2_23.8-in_touch_all-in-one_business_pc_firmware <= 2.18.00`\n- `eliteone_1000_g2_27-in_4k_uhd_all-in-one_business_pc_firmware <= 2.18.00`\n- `eliteone_1000_g2_34-in_curved_all-in-one_business_pc_firmware <= 2.18.00`\n- `eliteone_800_g4_23.8-in_healthcare_edition_all-in-one_business_pc_firmware <= 2.18.00`\n- `eliteone_800_g4_23.8-inch_non-touch_all-in-one_pc_firmware <= 2.18.00`\n- `eliteone_800_g4_23.8-inch_non-touch_gpu_all-in-one_pc_firmware <= 2.18.00`\n- `eliteone_800_g4_23.8-inch_touch_all-in-one_pc_firmware <= 2.18.00`\n- `eliteone_800_g4_23.8-inch_touch_gpu_all-in-one_pc_firmware <= 2.18.00`\n- `eliteone_800_g5_23.8-in_healthcare_edition_all-in-one_firmware <= 2.12.00`\n- `eliteone_800_g5_23.8-inch_all-in-one_firmware <= 2.12.00`\n- `eliteone_800_g6_24_all-in-one_pc_firmware <= 2.10.00`\n- `eliteone_800_g6_27_all-in-one_pc_firmware <= 2.10.00`\n- `eliteone_800_g8_24_all-in-one_pc_firmware <= 2.07.00`\n- `eliteone_800_g8_27_all-in-one_pc_firmware <= 2.07.00`\n- `prodesk_400_g4_desktop_mini_pc_firmware <= 2.18.00`\n- `prodesk_400_g5_desktop_mini_pc_firmware <= 2.12.00`\n- `prodesk_400_g5_microtower_pc_firmware <= 2.18.00`\n- `prodesk_400_g5_small_form_factor_pc_firmware <= 2.18.00`\n- `prodesk_400_g6_desktop_mini_pc_firmware <= 2.10.00`\n- `prodesk_400_g6_microtower_pc_firmware <= 2.12.00`\n- `prodesk_400_g6_small_form_factor_pc_firmware <= 2.12.00`\n- `prodesk_400_g7_microtower_pc_firmware <= 2.10.00`\n- `prodesk_400_g7_small_form_factor_pc_firmware <= 2.10.00`\n- `prodesk_405_g8_desktop_mini_pc_firmware <= 2.03.00`\n- `prodesk_405_g8_small_form_factor_pc_firmware <= 2.03.00`\n- `prodesk_480_g5_microtower_pc_firmware <= 2.18.00`\n- `prodesk_480_g6_microtower_pc_firmware <= 2.12.00`\n- `prodesk_480_g7_pci_microtower_pc_firmware <= 2.10.00`\n- `prodesk_600_g4_desktop_mini_pc_firmware <= 2.18.00`\n- `prodesk_600_g4_microtower_pc_firmware <= 2.18.00`\n- `prodesk_600_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00`\n- `prodesk_600_g4_small_form_factor_pc_firmware <= 2.18.00`\n- `prodesk_600_g5_desktop_mini_pc_firmware <= 2.12.00`\n- `prodesk_600_g5_microtower_pc_firmware <= 2.12.00`\n- `prodesk_600_g5_microtower_pc(with_pci_slot)_firmware <= 2.12.00`\n- `prodesk_600_g5_small_form_factor_pc_firmware <= 2.12.00`\n- `prodesk_600_g6_desktop_mini_pc_firmware <= 2.10.00`\n- `prodesk_600_g6_microtower_pc_firmware <= 2.10.00`\n- `prodesk_600_g6_small_form_factor_pc_firmware <= 2.10.00`\n- `prodesk_680_g4_microtower_pc_firmware <= 2.18.00`\n- `prodesk_680_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00`\n- `prodesk_680_g6_pci_microtower_pc_firmware <= 2.10.00`\n- `proone_400_g4_20-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00`\n- `proone_400_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00`\n- `proone_400_g5_20-inch_all-in-one_business_pc_firmware <= 2.12.00`\n- `proone_400_g5_23.8-inch_all-in-one_business_pc_firmware <= 2.12.00`\n- `proone_400_g6_20_all-in-one_pc_firmware <= 2.10.00`\n- `proone_400_g6_24_all-in-one_pc_firmware <= 2.10.00`\n- `proone_440_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00`\n- `proone_440_g5_23.8-in_all-in-one_business_pc_firmware <= 2.12.00`\n- `proone_440_g6_24_all-in-one_pc_firmware <= 2.10.00`\n- `proone_600_g4_21.5-inch_touch_all-in-one_business_pc_firmware <= 2.18.00`\n- `proone_600_g5_21.5-in_all-in-one_business_pc_firmware <= 2.12.00`\n- `proone_600_g6_22_all-in-one_pc_firmware <= 2.10.00`\n- `zhan_66_pro_g3_22_all-in-one_pc_firmware <= 2.10.00`\n- `zhan_66_pro_g3_24_all-in-one_pc_firmware <= 2.10.00`\n- `z1_entry_tower_g5_workstation_firmware < 02.12.00`\n- `z1_entry_tower_g6_workstation_firmware < 02.10.00`\n- `z1_g8_tower_desktop_pc_firmware < 02.07.00`\n- `z4_g4_workstation_(core-x)_firmware < 02.75`\n- `z4_g4_workstation_(xeon_w)_firmware < 02.75`\n- `z6_g4_workstation_firmware < 02.75`\n- `z8_g4_workstation_firmware < 02.75`\n- `engage_flex_mini_retail_system_firmware < 02.10.00`\n- `mp9_g4_retail_system_firmware < 02.18.00`\n- `elite_dragonfly_firmware < 01.12.00`\n- `elite_dragonfly_g2_firmware < 01.08.00`\n- `elite_dragonfly_max_firmware < 01.08.00`\n- `elite_x2_1013_g3_firmware < 01.19.00`\n- `elite_x2_g4_firmware < 01.12.00`\n- `elite_x2_g8_tablet_firmware < 01.08.00`\n- `elitebook_1050_g1_firmware < 01.19.00`\n- `elitebook_830_g5_firmware < 01.19.00`\n- `elitebook_830_g6_firmware < 01.12.00`\n- `elitebook_830_g7_firmware < 01.08.00`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `z1_entry_tower_g5_workstation_firmware 02.12.00`\n- `z1_entry_tower_g6_workstation_firmware 02.10.00`\n- `z1_g8_tower_desktop_pc_firmware 02.07.00`\n- `z4_g4_workstation_(core-x)_firmware 02.75`\n- `z4_g4_workstation_(xeon_w)_firmware 02.75`\n- `z6_g4_workstation_firmware 02.75`\n- `z8_g4_workstation_firmware 02.75`\n- `engage_flex_mini_retail_system_firmware 02.10.00`\n- `mp9_g4_retail_system_firmware 02.18.00`\n- `elite_dragonfly_firmware 01.12.00`\n- `elite_dragonfly_g2_firmware 01.08.00`\n- `elite_dragonfly_max_firmware 01.08.00`\n- `elite_x2_1013_g3_firmware 01.19.00`\n- `elite_x2_g4_firmware 01.12.00`\n- `elite_x2_g8_tablet_firmware 01.08.00`\n- `elitebook_1050_g1_firmware 01.19.00`\n- `elitebook_830_g5_firmware 01.19.00`\n- `elitebook_830_g6_firmware 01.12.00`\n- `elitebook_830_g7_firmware 01.08.00`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":217673,"id":"CVE-2021-39297","ts":1791402303686,"field":"cvss","old":"7.8","new":"8.8"}]}