CVE-2023-26299

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-26304.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-263007.8A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privile CVE-2023-263019.8Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a la CVE-2023-263025.5Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid CVE-2023-263035.5Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially craft CVE-2023-263099.8A remote code execution vulnerability in the webview component of OnePlus Store app.CVE-2023-26314.3A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attack CVE-2023-263109.8There is a command injection problem in the old version of the mobile phone backup app.CVE-2023-263119.8A remote code execution vulnerability in the webview component of OPPO Store app.CVE-2023-263148.8The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type CVE-2023-263158.8The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filter CVE-2023-263166.1A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking func