--- id: CVE-2021-39297 title: >- Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution. summary: >- Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H' cwe: - CWE-269 vendor: hp product: 260_g3_desktop_mini_pc_firmware affected: - 260_g3_desktop_mini_pc_firmware <= 2.17.00 - elitedesk_800_35w_g4_desktop_mini_pc_firmware <= 2.18.00 - elitedesk_800_65w_g4_desktop_mini_pc_firmware <= 2.18.00 - elitedesk_800_95w_g4_desktop_mini_pc_firmware <= 2.18.00 - elitedesk_800_g4_small_form_factor_pc_firmware <= 2.18.00 - elitedesk_800_g4_tower_pc_firmware <= 2.18.00 - elitedesk_800_g4_workstation_edition_firmware <= 2.18.00 - elitedesk_800_g5_desktop_mini_pc_firmware <= 2.12.00 - elitedesk_800_g5_small_form_factor_pc_firmware <= 2.12.00 - elitedesk_800_g5_tower_pc_firmware <= 2.12.00 - elitedesk_800_g6_desktop_mini_pc_firmware <= 2.10.00 - elitedesk_800_g6_small_form_factor_pc_firmware <= 2.10.00 - elitedesk_800_g6_tower_pc_firmware <= 2.10.00 - elitedesk_800_g8_desktop_mini_pc_firmware <= 2.07.00 - elitedesk_800_g8_small_form_factor_pc_firmware <= 2.07.00 - elitedesk_800_g8_tower_pc_firmware <= 2.07.00 - elitedesk_805_g6_desktop_mini_pc_firmware <= 2.07.00 - elitedesk_805_g6_small_form_factor_pc_firmware <= 2.07.00 - elitedesk_805_g8_desktop_mini_pc_firmware <= 2.03.00 - elitedesk_805_g8_small_form_factor_pc_firmware <= 2.03.00 - elitedesk_880_g4_tower_pc_firmware <= 2.18.00 - elitedesk_880_g5_tower_pc_firmware <= 2.12.00 - elitedesk_880_g6_tower_pc_firmware <= 2.10.00 - elitedesk_880_g8_tower_pc_firmware <= 2.07.00 - eliteone_1000_g2_23.8-in_all-in-one_business_pc_firmware <= 2.18.00 - eliteone_1000_g2_23.8-in_touch_all-in-one_business_pc_firmware <= 2.18.00 - eliteone_1000_g2_27-in_4k_uhd_all-in-one_business_pc_firmware <= 2.18.00 - eliteone_1000_g2_34-in_curved_all-in-one_business_pc_firmware <= 2.18.00 - >- eliteone_800_g4_23.8-in_healthcare_edition_all-in-one_business_pc_firmware <= 2.18.00 - eliteone_800_g4_23.8-inch_non-touch_all-in-one_pc_firmware <= 2.18.00 - eliteone_800_g4_23.8-inch_non-touch_gpu_all-in-one_pc_firmware <= 2.18.00 - eliteone_800_g4_23.8-inch_touch_all-in-one_pc_firmware <= 2.18.00 - eliteone_800_g4_23.8-inch_touch_gpu_all-in-one_pc_firmware <= 2.18.00 - eliteone_800_g5_23.8-in_healthcare_edition_all-in-one_firmware <= 2.12.00 - eliteone_800_g5_23.8-inch_all-in-one_firmware <= 2.12.00 - eliteone_800_g6_24_all-in-one_pc_firmware <= 2.10.00 - eliteone_800_g6_27_all-in-one_pc_firmware <= 2.10.00 - eliteone_800_g8_24_all-in-one_pc_firmware <= 2.07.00 - eliteone_800_g8_27_all-in-one_pc_firmware <= 2.07.00 - prodesk_400_g4_desktop_mini_pc_firmware <= 2.18.00 - prodesk_400_g5_desktop_mini_pc_firmware <= 2.12.00 - prodesk_400_g5_microtower_pc_firmware <= 2.18.00 - prodesk_400_g5_small_form_factor_pc_firmware <= 2.18.00 - prodesk_400_g6_desktop_mini_pc_firmware <= 2.10.00 - prodesk_400_g6_microtower_pc_firmware <= 2.12.00 - prodesk_400_g6_small_form_factor_pc_firmware <= 2.12.00 - prodesk_400_g7_microtower_pc_firmware <= 2.10.00 - prodesk_400_g7_small_form_factor_pc_firmware <= 2.10.00 - prodesk_405_g8_desktop_mini_pc_firmware <= 2.03.00 - prodesk_405_g8_small_form_factor_pc_firmware <= 2.03.00 - prodesk_480_g5_microtower_pc_firmware <= 2.18.00 - prodesk_480_g6_microtower_pc_firmware <= 2.12.00 - prodesk_480_g7_pci_microtower_pc_firmware <= 2.10.00 - prodesk_600_g4_desktop_mini_pc_firmware <= 2.18.00 - prodesk_600_g4_microtower_pc_firmware <= 2.18.00 - prodesk_600_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00 - prodesk_600_g4_small_form_factor_pc_firmware <= 2.18.00 - prodesk_600_g5_desktop_mini_pc_firmware <= 2.12.00 - prodesk_600_g5_microtower_pc_firmware <= 2.12.00 - prodesk_600_g5_microtower_pc(with_pci_slot)_firmware <= 2.12.00 - prodesk_600_g5_small_form_factor_pc_firmware <= 2.12.00 - prodesk_600_g6_desktop_mini_pc_firmware <= 2.10.00 - prodesk_600_g6_microtower_pc_firmware <= 2.10.00 - prodesk_600_g6_small_form_factor_pc_firmware <= 2.10.00 - prodesk_680_g4_microtower_pc_firmware <= 2.18.00 - prodesk_680_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00 - prodesk_680_g6_pci_microtower_pc_firmware <= 2.10.00 - proone_400_g4_20-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00 - proone_400_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00 - proone_400_g5_20-inch_all-in-one_business_pc_firmware <= 2.12.00 - proone_400_g5_23.8-inch_all-in-one_business_pc_firmware <= 2.12.00 - proone_400_g6_20_all-in-one_pc_firmware <= 2.10.00 - proone_400_g6_24_all-in-one_pc_firmware <= 2.10.00 - proone_440_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00 - proone_440_g5_23.8-in_all-in-one_business_pc_firmware <= 2.12.00 - proone_440_g6_24_all-in-one_pc_firmware <= 2.10.00 - proone_600_g4_21.5-inch_touch_all-in-one_business_pc_firmware <= 2.18.00 - proone_600_g5_21.5-in_all-in-one_business_pc_firmware <= 2.12.00 - proone_600_g6_22_all-in-one_pc_firmware <= 2.10.00 - zhan_66_pro_g3_22_all-in-one_pc_firmware <= 2.10.00 - zhan_66_pro_g3_24_all-in-one_pc_firmware <= 2.10.00 - z1_entry_tower_g5_workstation_firmware < 02.12.00 - z1_entry_tower_g6_workstation_firmware < 02.10.00 - z1_g8_tower_desktop_pc_firmware < 02.07.00 - z4_g4_workstation_(core-x)_firmware < 02.75 - z4_g4_workstation_(xeon_w)_firmware < 02.75 - z6_g4_workstation_firmware < 02.75 - z8_g4_workstation_firmware < 02.75 - engage_flex_mini_retail_system_firmware < 02.10.00 - mp9_g4_retail_system_firmware < 02.18.00 - elite_dragonfly_firmware < 01.12.00 - elite_dragonfly_g2_firmware < 01.08.00 - elite_dragonfly_max_firmware < 01.08.00 - elite_x2_1013_g3_firmware < 01.19.00 - elite_x2_g4_firmware < 01.12.00 - elite_x2_g8_tablet_firmware < 01.08.00 - elitebook_1050_g1_firmware < 01.19.00 - elitebook_830_g5_firmware < 01.19.00 - elitebook_830_g6_firmware < 01.12.00 - elitebook_830_g7_firmware < 01.08.00 patched: - z1_entry_tower_g5_workstation_firmware 02.12.00 - z1_entry_tower_g6_workstation_firmware 02.10.00 - z1_g8_tower_desktop_pc_firmware 02.07.00 - z4_g4_workstation_(core-x)_firmware 02.75 - z4_g4_workstation_(xeon_w)_firmware 02.75 - z6_g4_workstation_firmware 02.75 - z8_g4_workstation_firmware 02.75 - engage_flex_mini_retail_system_firmware 02.10.00 - mp9_g4_retail_system_firmware 02.18.00 - elite_dragonfly_firmware 01.12.00 - elite_dragonfly_g2_firmware 01.08.00 - elite_dragonfly_max_firmware 01.08.00 - elite_x2_1013_g3_firmware 01.19.00 - elite_x2_g4_firmware 01.12.00 - elite_x2_g8_tablet_firmware 01.08.00 - elitebook_1050_g1_firmware 01.19.00 - elitebook_830_g5_firmware 01.19.00 - elitebook_830_g6_firmware 01.12.00 - elitebook_830_g7_firmware 01.08.00 published: '2022-02-16' updated: '2026-10-07' sourceUpdated: '2026-10-07T19:17:28.350' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-39297' references: - url: 'https://support.hp.com/us-en/document/ish_5661066-5661090-16' label: hp-security-alert@hp.com - url: 'https://support.hp.com/us-en/document/ish_5661066-5661090-16' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org epss: 0.00441 epssPercentile: 0.36176 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-07T18:09:34.194302Z' scores: nvd: 8.8 adp: 7.8 ingestedAt: '2026-10-07T18:42:20.904Z' --- ## Overview Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution. ## Affected - `260_g3_desktop_mini_pc_firmware <= 2.17.00` - `elitedesk_800_35w_g4_desktop_mini_pc_firmware <= 2.18.00` - `elitedesk_800_65w_g4_desktop_mini_pc_firmware <= 2.18.00` - `elitedesk_800_95w_g4_desktop_mini_pc_firmware <= 2.18.00` - `elitedesk_800_g4_small_form_factor_pc_firmware <= 2.18.00` - `elitedesk_800_g4_tower_pc_firmware <= 2.18.00` - `elitedesk_800_g4_workstation_edition_firmware <= 2.18.00` - `elitedesk_800_g5_desktop_mini_pc_firmware <= 2.12.00` - `elitedesk_800_g5_small_form_factor_pc_firmware <= 2.12.00` - `elitedesk_800_g5_tower_pc_firmware <= 2.12.00` - `elitedesk_800_g6_desktop_mini_pc_firmware <= 2.10.00` - `elitedesk_800_g6_small_form_factor_pc_firmware <= 2.10.00` - `elitedesk_800_g6_tower_pc_firmware <= 2.10.00` - `elitedesk_800_g8_desktop_mini_pc_firmware <= 2.07.00` - `elitedesk_800_g8_small_form_factor_pc_firmware <= 2.07.00` - `elitedesk_800_g8_tower_pc_firmware <= 2.07.00` - `elitedesk_805_g6_desktop_mini_pc_firmware <= 2.07.00` - `elitedesk_805_g6_small_form_factor_pc_firmware <= 2.07.00` - `elitedesk_805_g8_desktop_mini_pc_firmware <= 2.03.00` - `elitedesk_805_g8_small_form_factor_pc_firmware <= 2.03.00` - `elitedesk_880_g4_tower_pc_firmware <= 2.18.00` - `elitedesk_880_g5_tower_pc_firmware <= 2.12.00` - `elitedesk_880_g6_tower_pc_firmware <= 2.10.00` - `elitedesk_880_g8_tower_pc_firmware <= 2.07.00` - `eliteone_1000_g2_23.8-in_all-in-one_business_pc_firmware <= 2.18.00` - `eliteone_1000_g2_23.8-in_touch_all-in-one_business_pc_firmware <= 2.18.00` - `eliteone_1000_g2_27-in_4k_uhd_all-in-one_business_pc_firmware <= 2.18.00` - `eliteone_1000_g2_34-in_curved_all-in-one_business_pc_firmware <= 2.18.00` - `eliteone_800_g4_23.8-in_healthcare_edition_all-in-one_business_pc_firmware <= 2.18.00` - `eliteone_800_g4_23.8-inch_non-touch_all-in-one_pc_firmware <= 2.18.00` - `eliteone_800_g4_23.8-inch_non-touch_gpu_all-in-one_pc_firmware <= 2.18.00` - `eliteone_800_g4_23.8-inch_touch_all-in-one_pc_firmware <= 2.18.00` - `eliteone_800_g4_23.8-inch_touch_gpu_all-in-one_pc_firmware <= 2.18.00` - `eliteone_800_g5_23.8-in_healthcare_edition_all-in-one_firmware <= 2.12.00` - `eliteone_800_g5_23.8-inch_all-in-one_firmware <= 2.12.00` - `eliteone_800_g6_24_all-in-one_pc_firmware <= 2.10.00` - `eliteone_800_g6_27_all-in-one_pc_firmware <= 2.10.00` - `eliteone_800_g8_24_all-in-one_pc_firmware <= 2.07.00` - `eliteone_800_g8_27_all-in-one_pc_firmware <= 2.07.00` - `prodesk_400_g4_desktop_mini_pc_firmware <= 2.18.00` - `prodesk_400_g5_desktop_mini_pc_firmware <= 2.12.00` - `prodesk_400_g5_microtower_pc_firmware <= 2.18.00` - `prodesk_400_g5_small_form_factor_pc_firmware <= 2.18.00` - `prodesk_400_g6_desktop_mini_pc_firmware <= 2.10.00` - `prodesk_400_g6_microtower_pc_firmware <= 2.12.00` - `prodesk_400_g6_small_form_factor_pc_firmware <= 2.12.00` - `prodesk_400_g7_microtower_pc_firmware <= 2.10.00` - `prodesk_400_g7_small_form_factor_pc_firmware <= 2.10.00` - `prodesk_405_g8_desktop_mini_pc_firmware <= 2.03.00` - `prodesk_405_g8_small_form_factor_pc_firmware <= 2.03.00` - `prodesk_480_g5_microtower_pc_firmware <= 2.18.00` - `prodesk_480_g6_microtower_pc_firmware <= 2.12.00` - `prodesk_480_g7_pci_microtower_pc_firmware <= 2.10.00` - `prodesk_600_g4_desktop_mini_pc_firmware <= 2.18.00` - `prodesk_600_g4_microtower_pc_firmware <= 2.18.00` - `prodesk_600_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00` - `prodesk_600_g4_small_form_factor_pc_firmware <= 2.18.00` - `prodesk_600_g5_desktop_mini_pc_firmware <= 2.12.00` - `prodesk_600_g5_microtower_pc_firmware <= 2.12.00` - `prodesk_600_g5_microtower_pc(with_pci_slot)_firmware <= 2.12.00` - `prodesk_600_g5_small_form_factor_pc_firmware <= 2.12.00` - `prodesk_600_g6_desktop_mini_pc_firmware <= 2.10.00` - `prodesk_600_g6_microtower_pc_firmware <= 2.10.00` - `prodesk_600_g6_small_form_factor_pc_firmware <= 2.10.00` - `prodesk_680_g4_microtower_pc_firmware <= 2.18.00` - `prodesk_680_g4_microtower_pc(with_pci_slot)_firmware <= 2.18.00` - `prodesk_680_g6_pci_microtower_pc_firmware <= 2.10.00` - `proone_400_g4_20-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00` - `proone_400_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00` - `proone_400_g5_20-inch_all-in-one_business_pc_firmware <= 2.12.00` - `proone_400_g5_23.8-inch_all-in-one_business_pc_firmware <= 2.12.00` - `proone_400_g6_20_all-in-one_pc_firmware <= 2.10.00` - `proone_400_g6_24_all-in-one_pc_firmware <= 2.10.00` - `proone_440_g4_23.8-inch_non-touch_all-in-one_business_pc_firmware <= 2.18.00` - `proone_440_g5_23.8-in_all-in-one_business_pc_firmware <= 2.12.00` - `proone_440_g6_24_all-in-one_pc_firmware <= 2.10.00` - `proone_600_g4_21.5-inch_touch_all-in-one_business_pc_firmware <= 2.18.00` - `proone_600_g5_21.5-in_all-in-one_business_pc_firmware <= 2.12.00` - `proone_600_g6_22_all-in-one_pc_firmware <= 2.10.00` - `zhan_66_pro_g3_22_all-in-one_pc_firmware <= 2.10.00` - `zhan_66_pro_g3_24_all-in-one_pc_firmware <= 2.10.00` - `z1_entry_tower_g5_workstation_firmware < 02.12.00` - `z1_entry_tower_g6_workstation_firmware < 02.10.00` - `z1_g8_tower_desktop_pc_firmware < 02.07.00` - `z4_g4_workstation_(core-x)_firmware < 02.75` - `z4_g4_workstation_(xeon_w)_firmware < 02.75` - `z6_g4_workstation_firmware < 02.75` - `z8_g4_workstation_firmware < 02.75` - `engage_flex_mini_retail_system_firmware < 02.10.00` - `mp9_g4_retail_system_firmware < 02.18.00` - `elite_dragonfly_firmware < 01.12.00` - `elite_dragonfly_g2_firmware < 01.08.00` - `elite_dragonfly_max_firmware < 01.08.00` - `elite_x2_1013_g3_firmware < 01.19.00` - `elite_x2_g4_firmware < 01.12.00` - `elite_x2_g8_tablet_firmware < 01.08.00` - `elitebook_1050_g1_firmware < 01.19.00` - `elitebook_830_g5_firmware < 01.19.00` - `elitebook_830_g6_firmware < 01.12.00` - `elitebook_830_g7_firmware < 01.08.00` ## Remediation Upgrade past the affected range: - `z1_entry_tower_g5_workstation_firmware 02.12.00` - `z1_entry_tower_g6_workstation_firmware 02.10.00` - `z1_g8_tower_desktop_pc_firmware 02.07.00` - `z4_g4_workstation_(core-x)_firmware 02.75` - `z4_g4_workstation_(xeon_w)_firmware 02.75` - `z6_g4_workstation_firmware 02.75` - `z8_g4_workstation_firmware 02.75` - `engage_flex_mini_retail_system_firmware 02.10.00` - `mp9_g4_retail_system_firmware 02.18.00` - `elite_dragonfly_firmware 01.12.00` - `elite_dragonfly_g2_firmware 01.08.00` - `elite_dragonfly_max_firmware 01.08.00` - `elite_x2_1013_g3_firmware 01.19.00` - `elite_x2_g4_firmware 01.12.00` - `elite_x2_g8_tablet_firmware 01.08.00` - `elitebook_1050_g1_firmware 01.19.00` - `elitebook_830_g5_firmware 01.19.00` - `elitebook_830_g6_firmware 01.12.00` - `elitebook_830_g7_firmware 01.08.00`