CVE-2023-26299

HIGH

HP 260 G4 Desktop Mini Firmware < 2.14 - Time-of-Check Time-of-Use Race Condition

Title source: llm
STIX 2.1

Description

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

References (1)

Core 1

Scores

CVSS v3 7.0
EPSS 0.0019
EPSS Percentile 40.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-367
Status published
Products (50)
hp/200_g3_firmware
hp/200_g4_22_all-in-one_firmware
hp/200_pro_g4_22_all-in-one_firmware
hp/205_g4_22_all-in-one_firmware
hp/205_pro_g4_22_all-in-one_firmware
hp/240_g10_firmware < f.04
hp/245_g6_firmware < f.35
hp/245_g7_firmware < f.69
hp/245_g8_firmware < f.25
hp/247_g8_firmware < f.69
... and 40 more
Published Jun 30, 2023
Tracked Since Feb 18, 2026