CVE-2022-31646

Q: What is the severity of CVE-2022-31646?

CVE-2022-31646 has a CVSS score of 7.8 (HIGH). This CVE describes BIOS vulnerabilities in certain HP PC products that could allow attackers to execute arbitrary code, escalate privileges, cause denial of service, or disclose sensitive information. The vulnerability affects HP PC users with specific BIOS versions. Attackers would need physical or administrative access to exploit these flaws.

7.8 HIGH

📋 TL;DR

This CVE describes BIOS vulnerabilities in certain HP PC products that could allow attackers to execute arbitrary code, escalate privileges, cause denial of service, or disclose sensitive information. The vulnerability affects HP PC users with specific BIOS versions. Attackers would need physical or administrative access to exploit these flaws.

💻 Affected Systems

Products:

HP PC products (specific models listed in HP advisory)

Versions: BIOS versions prior to those specified in HP security bulletin

Operating Systems: All operating systems running on affected hardware

Default Config Vulnerable: ⚠️ Yes

Notes: Affects specific HP PC models; check HP advisory for exact model list. BIOS vulnerabilities affect all OS layers.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with persistent malware at firmware level, allowing attackers to bypass operating system security controls and maintain persistence across OS reinstalls.

🟠

Likely Case

Local attacker with administrative access could install persistent malware or extract sensitive information from firmware.

🟢

If Mitigated

With proper access controls and BIOS password protection, risk is limited to authorized administrators only.

🌐 Internet-Facing: LOW - Requires local access to system; not remotely exploitable over network.

🏢 Internal Only: MEDIUM - Internal attackers with physical or administrative access could exploit these vulnerabilities.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and BIOS/UEFI knowledge. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: BIOS updates specified in HP Security Bulletin HPSBHF03806

Vendor Advisory: https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806

Restart Required: Yes

Instructions:

1. Identify your HP PC model. 2. Visit HP Support website. 3. Download latest BIOS update for your model. 4. Run BIOS update utility. 5. Restart system when prompted.

🔧 Temporary Workarounds

BIOS Password Protection

all

Set BIOS administrator password to prevent unauthorized BIOS modifications

Access BIOS/UEFI settings during boot (typically F10 or ESC)
Navigate to Security settings
Set Administrator Password

Physical Security Controls

all

Restrict physical access to vulnerable systems

🧯 If You Can't Patch

Implement strict physical access controls to prevent unauthorized local access
Enable BIOS password protection and secure boot features

🔍 How to Verify

Check if Vulnerable:

Check BIOS version in system information (Windows: msinfo32, Linux: dmidecode -t bios) and compare against HP advisory

Check Version:

Windows: wmic bios get smbiosbiosversion | Linux: dmidecode -s bios-version

Verify Fix Applied:

Verify BIOS version after update matches patched version in HP advisory

📡 Detection & Monitoring

Log Indicators:

BIOS/UEFI firmware modification events
Unauthorized physical access logs
Failed BIOS password attempts

Network Indicators:

Not applicable - local exploit only

SIEM Query:

Event ID 12 (System) with BIOS/UEFI firmware changes on Windows systems

📊 Metadata

CVE ID: CVE-2022-31646

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-863

Published: June 14, 2023

Last Updated: December 30, 2024

🔗 References

https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806 Vendor Advisory
https://support.hp.com/us-en/document/ish_6664419-6664458-16/hpsbhf03806 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Dragonfly Folio G3 2 In 1 Firmware by Hp

Elite Dragonfly Firmware by Hp

Elite Dragonfly G2 Firmware by Hp

Elite Dragonfly G3 Firmware by Hp

Elite Dragonfly Max Firmware by Hp

Elite Folio 2 In 1 Firmware by Hp

Elite Mini 600 G9 Firmware by Hp

Elite Mini 800 G9 Firmware by Hp

Elite Sff 600 G9 Firmware by Hp

Elite Sff 800 G9 Firmware by Hp

Elite Slice Firmware by Hp

Elite Slice G2 Firmware by Hp

Elite Tower 600 G9 Firmware by Hp

Elite Tower 680 G9 Firmware by Hp

Elite Tower 800 G9 Firmware by Hp

Elite Tower 880 G9 Firmware by Hp

Elite X2 1012 G1 Firmware by Hp

Elite X2 1012 G2 Firmware by Hp

Elite X2 1013 G3 Firmware by Hp

Elite X2 G4 Firmware by Hp

Elite X2 G8 Firmware by Hp

Elite X360 1040 G9 2 In 1 Firmware by Hp

Elite X360 830 G9 2 In 1 Firmware by Hp

Elitebook 1030 G1 Firmware by Hp

Elitebook 1040 G3 Firmware by Hp

Elitebook 1040 G4 Firmware by Hp

Elitebook 1040 G9 Firmware by Hp

Elitebook 1050 G1 Firmware by Hp

Elitebook 630 G9 Firmware by Hp

Elitebook 640 G9 Firmware by Hp

Elitebook 645 G9 Firmware by Hp

Elitebook 650 G9 Firmware by Hp

Elitebook 655 G9 Firmware by Hp

Elitebook 735 G5 Firmware by Hp

Elitebook 735 G6 Firmware by Hp

Elitebook 745 G5 Firmware by Hp

Elitebook 745 G6 Firmware by Hp

Elitebook 755 G5 Firmware by Hp

Elitebook 830 G5 Firmware by Hp

Elitebook 830 G6 Firmware by Hp

Elitebook 830 G7 Firmware by Hp

Elitebook 830 G8 Firmware by Hp

Elitebook 830 G9 Firmware by Hp

Elitebook 835 G7 Firmware by Hp

Elitebook 835 G8 Firmware by Hp

Elitebook 835 G9 Firmware by Hp

Elitebook 836 G5 Firmware by Hp

Elitebook 836 G6 Firmware by Hp

Elitebook 840 Aero G8 Firmware by Hp

Elitebook 840 G5 Firmware by Hp

Elitebook 840 G6 Firmware by Hp

Elitebook 840 G7 Firmware by Hp

Elitebook 840 G8 Firmware by Hp

Elitebook 840 G9 Firmware by Hp

Elitebook 840r G4 Firmware by Hp

Elitebook 845 G7 Firmware by Hp

Elitebook 845 G8 Firmware by Hp

Elitebook 845 G9 Firmware by Hp

Elitebook 846 G5 Firmware by Hp

Elitebook 850 G5 Firmware by Hp

Elitebook 850 G6 Firmware by Hp

Elitebook 850 G7 Firmware by Hp

Elitebook 850 G8 Firmware by Hp

Elitebook 855 G7 Firmware by Hp

Elitebook 855 G8 Firmware by Hp

Elitebook 860 G9 Firmware by Hp

Elitebook 865 G9 Firmware by Hp

Elitebook X360 1030 G3 Firmware by Hp

Elitebook X360 1030 G4 Firmware by Hp

Elitebook X360 1030 G7 Firmware by Hp

Elitebook X360 1030 G8 Firmware by Hp

Elitebook X360 1040 G5 Firmware by Hp

Elitebook X360 1040 G6 Firmware by Hp

Elitebook X360 1040 G7 Firmware by Hp

Elitebook X360 1040 G8 Firmware by Hp

Elitebook X360 830 G5 Firmware by Hp

Elitebook X360 830 G6 Firmware by Hp