CVE-2021-39299

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS	before 01.12.00; before 01.08.00; before 01.19.00; before 01.08.02; before 01.08.01; before 02.17.00; before 02.18.00; before 02.12.00; before 02.10.00; before 02.07.00; before 02.03.00; before 02.75; before 2.58

References

https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory
https://support.hp.com/us-en/document/ish_5661066-5661090-16Patch, Vendor Advisory

Timeline

Published: Feb 16, 2022
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-39306.5An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page(CVE-2021-393008.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-393018.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi CVE-2021-393029.8MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.CVE-2021-393039.8The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vu CVE-2021-393047.5Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.CVE-2021-393069.8A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big CVE-2021-393076.1PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the exe CVE-2021-393086.1The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in CVE-2021-393096.1The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dum CVE-2021-39314.3snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-393106.1The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file