CVE-2022-27537

Q: What is the severity of CVE-2022-27537?

CVE-2022-27537 has a CVSS score of 7.8 (HIGH). This CVE describes vulnerabilities in the system BIOS of certain HP PC products that could allow attackers to execute arbitrary code, escalate privileges, cause denial of service, or disclose sensitive information. The vulnerability affects HP PC users with vulnerable BIOS versions. Attackers could potentially compromise the system firmware itself.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes vulnerabilities in the system BIOS of certain HP PC products that could allow attackers to execute arbitrary code, escalate privileges, cause denial of service, or disclose sensitive information. The vulnerability affects HP PC users with vulnerable BIOS versions. Attackers could potentially compromise the system firmware itself.

💻 Affected Systems

Products:

Certain HP PC products (specific models not listed in provided references)

Versions: Specific BIOS versions not detailed in provided references

Operating Systems: All operating systems running on affected hardware

Default Config Vulnerable: ⚠️ Yes

Notes: Affects the system BIOS firmware itself, independent of operating system. All configurations with vulnerable BIOS are affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with persistent malware in firmware, allowing attackers to maintain control even after OS reinstallation, steal encryption keys and credentials, and disable security controls.

🟠

Likely Case

Local privilege escalation allowing attackers to gain administrative access, install persistent malware, or access sensitive system information.

🟢

If Mitigated

Limited impact with proper patch management and security controls, potentially only affecting isolated systems with no network access.

🌐 Internet-Facing: LOW - BIOS vulnerabilities typically require local access or physical presence, though remote exploitation might be possible through other attack vectors.

🏢 Internal Only: MEDIUM - Internal attackers with physical or local access could exploit this vulnerability to gain persistent access to systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

BIOS exploitation typically requires local access and specialized knowledge. HP describes these as 'potential vulnerabilities' suggesting no confirmed exploitation in the wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Updated BIOS versions from HP

Vendor Advisory: https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806

Restart Required: Yes

Instructions:

1. Visit HP Support website. 2. Enter your HP PC model. 3. Download latest BIOS update. 4. Run BIOS update utility. 5. Restart system as prompted. 6. Verify BIOS version updated.

🔧 Temporary Workarounds

Physical Security Controls

all

Restrict physical access to vulnerable systems to prevent local exploitation

BIOS Password Protection

all

Enable BIOS/UEFI password to prevent unauthorized BIOS modifications

🧯 If You Can't Patch

Isolate affected systems from critical networks and sensitive data
Implement strict physical security controls and monitor for unauthorized access

🔍 How to Verify

Check if Vulnerable:

Check current BIOS version in system settings (F10 during boot on HP systems) or using 'wmic bios get smbiosbiosversion' on Windows

Check Version:

Windows: wmic bios get smbiosbiosversion
Linux: sudo dmidecode -s bios-version

Verify Fix Applied:

Verify BIOS version matches or exceeds the patched version listed in HP's advisory

📡 Detection & Monitoring

Log Indicators:

BIOS/UEFI modification events in system logs
Unexpected system restarts or firmware update attempts

Network Indicators:

Unusual outbound connections from system management interfaces

SIEM Query:

EventID=12 OR EventID=13 (System events) AND (Description contains 'BIOS' OR Description contains 'firmware')

📊 Metadata

CVE ID: CVE-2022-27537

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: February 1, 2023

Last Updated: March 27, 2025

🔗 References

https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806 Vendor Advisory
https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Dragonfly Folio G3 2 In 1 Firmware by Hp

Elite Dragonfly Firmware by Hp

Elite Dragonfly G2 Firmware by Hp

Elite Dragonfly G3 Firmware by Hp

Elite Dragonfly Max Firmware by Hp

Elite Folio 2 In 1 Firmware by Hp

Elite Mini 600 G9 Firmware by Hp

Elite Mini 800 G9 Firmware by Hp

Elite Sff 600 G9 Firmware by Hp

Elite Sff 800 G9 Firmware by Hp

Elite Slice Firmware by Hp

Elite Slice G2 Firmware by Hp

Elite Tower 600 G9 Firmware by Hp

Elite Tower 680 G9 Firmware by Hp

Elite Tower 800 G9 Firmware by Hp

Elite Tower 880 G9 Firmware by Hp

Elite X2 1012 G1 Firmware by Hp

Elite X2 1012 G2 Firmware by Hp

Elite X2 1013 G3 Firmware by Hp

Elite X2 G4 Firmware by Hp

Elite X2 G8 Firmware by Hp

Elite X360 1040 G9 2 In 1 Firmware by Hp

Elite X360 830 G9 2 In 1 Firmware by Hp

Elitebook 1030 G1 Firmware by Hp

Elitebook 1040 G3 Firmware by Hp

Elitebook 1040 G4 Firmware by Hp

Elitebook 1040 G9 Firmware by Hp

Elitebook 1050 G1 Firmware by Hp

Elitebook 630 G9 Firmware by Hp

Elitebook 640 G9 Firmware by Hp

Elitebook 645 G9 Firmware by Hp

Elitebook 650 G9 Firmware by Hp

Elitebook 655 G9 Firmware by Hp

Elitebook 735 G5 Firmware by Hp

Elitebook 735 G6 Firmware by Hp

Elitebook 745 G5 Firmware by Hp

Elitebook 745 G6 Firmware by Hp

Elitebook 755 G5 Firmware by Hp

Elitebook 830 G5 Firmware by Hp

Elitebook 830 G6 Firmware by Hp

Elitebook 830 G7 Firmware by Hp

Elitebook 830 G8 Firmware by Hp

Elitebook 830 G9 Firmware by Hp

Elitebook 835 G7 Firmware by Hp

Elitebook 835 G8 Firmware by Hp

Elitebook 835 G9 Firmware by Hp

Elitebook 836 G5 Firmware by Hp

Elitebook 836 G6 Firmware by Hp

Elitebook 840 Aero G8 Firmware by Hp

Elitebook 840 G5 Firmware by Hp

Elitebook 840 G6 Firmware by Hp

Elitebook 840 G7 Firmware by Hp

Elitebook 840 G8 Firmware by Hp

Elitebook 840 G9 Firmware by Hp

Elitebook 840r G4 Firmware by Hp

Elitebook 845 G7 Firmware by Hp

Elitebook 845 G8 Firmware by Hp

Elitebook 845 G9 Firmware by Hp

Elitebook 846 G5 Firmware by Hp

Elitebook 850 G5 Firmware by Hp

Elitebook 850 G6 Firmware by Hp

Elitebook 850 G7 Firmware by Hp

Elitebook 850 G8 Firmware by Hp

Elitebook 855 G7 Firmware by Hp

Elitebook 855 G8 Firmware by Hp

Elitebook 860 G9 Firmware by Hp

Elitebook 865 G9 Firmware by Hp

Elitebook X360 1030 G3 Firmware by Hp

Elitebook X360 1030 G4 Firmware by Hp

Elitebook X360 1030 G7 Firmware by Hp

Elitebook X360 1030 G8 Firmware by Hp

Elitebook X360 1040 G5 Firmware by Hp

Elitebook X360 1040 G6 Firmware by Hp

Elitebook X360 1040 G7 Firmware by Hp

Elitebook X360 1040 G8 Firmware by Hp

Elitebook X360 830 G5 Firmware by Hp

Elitebook X360 830 G6 Firmware by Hp