CVE-2023-6138

HighCVSS 7.9/10Last modified Jun 17, 2026

Description

A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
HP Inc.	Certain HP Workstation PCs	See HP Security Bulletin reference for affected versions.

References

https://support.hp.com/us-en/document/ish_10167884-10167908-16/hpsbhf03915Vendor Advisory
https://support.hp.com/us-en/document/ish_10167884-10167908-16/hpsbhf03915Vendor Advisory

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-61396.5The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thing CVE-2023-61408.8The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from m CVE-2023-61415.4The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thing CVE-2023-61425.4Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker CVE-2023-61438.4Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm CVE-2023-61444.8Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by CVE-2023-61459.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consulta CVE-2023-61465.4A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of log CVE-2023-61476.5Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was CVE-2023-61485.4Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was CVE-2023-61496.5Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a pe CVE-2023-61507.5Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue