CVE-2022-37019

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
HP Inc.	HP PC products	See HP security bulletin reference for affected versions

References

https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943Vendor Advisory
https://support.hp.com/us-en/document/ish_10737430-10737454-16/hpsbhf03943Vendor Advisory

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-37027.1A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local at CVE-2022-370206.8Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and CVE-2022-370219.8Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on CVE-2022-370228.8Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11.CVE-2022-370236.5Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. A CVE-2022-370248.8Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 t CVE-2022-370257.8An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a con CVE-2022-370269.8In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-cert CVE-2022-370277.2Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime CVE-2022-370285.4ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScrip CVE-2022-370310.0All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages CVE-2022-370307.8Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user