CVE-2021-39300

8.8 HIGH

📋 TL;DR

This CVE describes UEFI firmware vulnerabilities in certain HP PC products that could allow attackers to execute arbitrary code with elevated privileges. The vulnerability affects the system's BIOS/firmware layer, potentially compromising the entire system before the operating system loads. Only specific HP PC models with vulnerable UEFI firmware are affected.

💻 Affected Systems

Products:
  • HP PC products with vulnerable UEFI firmware
Versions: Specific firmware versions not detailed in references
Operating Systems: All operating systems running on affected hardware
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists at firmware level, so OS configuration doesn't matter. Only specific HP PC models are affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with persistent malware that survives OS reinstallation and disk formatting, allowing attackers to maintain long-term access and control over the device.

🟠

Likely Case

Local privilege escalation allowing attackers to bypass security controls, install persistent malware, or access sensitive system resources.

🟢

If Mitigated

Limited impact if physical access controls are strong and users have limited privileges, though firmware-level attacks remain difficult to detect.

🌐 Internet-Facing: LOW
🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: HIGH

Firmware exploitation typically requires local access and specialized knowledge. No public exploit code is mentioned in the references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Updated UEFI firmware versions from HP

Vendor Advisory: https://support.hp.com/us-en/document/ish_5661066-5661090-16

Restart Required: Yes

Instructions:

1. Visit HP Support website. 2. Enter your HP PC model. 3. Download latest UEFI firmware update. 4. Run the update utility. 5. Restart system as prompted.

🔧 Temporary Workarounds

Physical Security Controls

all

Restrict physical access to vulnerable systems to prevent local exploitation

Secure Boot Enforcement

all

Enable and enforce Secure Boot in UEFI settings to prevent unauthorized firmware modifications

🧯 If You Can't Patch

  • Isolate affected systems from critical networks and sensitive data
  • Implement strict physical access controls and monitoring for affected devices

🔍 How to Verify

Check if Vulnerable:

Check HP Support site with your PC model to see if it's listed as affected

Check Version:

Windows: wmic bios get smbiosbiosversion
Linux: sudo dmidecode -s bios-version

Verify Fix Applied:

Check UEFI firmware version in BIOS settings matches latest version from HP Support

📡 Detection & Monitoring

Log Indicators:

  • Unexpected BIOS/UEFI firmware modification events
  • System boot anomalies

Network Indicators:

  • Unusual outbound connections during boot process

SIEM Query:

EventID=12 OR EventID=13 (System boot events) with suspicious details

🔗 References

📤 Share & Export