CVE-2022-27540

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
HP Inc.	HP PC BIOS	See HP Security Bulletin reference for affected versions.

References

https://support.hp.com/us-en/document/ish_10810714-10810745-16/hpsbhf03948Vendor Advisory
https://support.hp.com/us-en/document/ish_10810714-10810745-16/hpsbhf03948Vendor Advisory

Timeline

Published: Jun 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-275417.8Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all CVE-2022-275446.5BigFix Web Reports authorized users may see SMTP credentials in clear text.CVE-2022-275455.4BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-275466.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input suppl CVE-2022-275477.4HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supp CVE-2022-275485.5HCL Launch stores user credentials in plain clear text which can be read by a local user.CVE-2022-275495.5HCL Launch may store certain data for recurring activities in a plain text format.CVE-2022-275516.5HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.CVE-2022-275587.5HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes fo CVE-2022-27566.5Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.CVE-2022-275606.5HCL VersionVault Express exposes administrator credentials.CVE-2022-275614.8There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).