Read the docs
TI-2017-01992 Aliases CVE-2017-2751GHSA-82wv-qvfh-pqc2

Insufficiently protected credentials in Hewlett Packard Enterprise HP 240 G1 Notebook PC…

Priority LOW 23CWE-522Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.

Why it matters now

EPSS 0.01074 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hewlett Packard EnterpriseHP 240 G1 Notebook PC and certain other consumer notebooksF.22 and other firmware versions—No fix listedCNA
  • HP 240 G1 Notebook PC and certain other consumer notebooks VendorHewlett Packard Enterprise Affected F.22 and other firmware versions Fixed in — No fix listed CNA

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:o:hp:hp_240_g1_firmware:*:*:*:*:*:*:*:*before f.48VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_240_g1:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_245_g1_firmware:*:*:*:*:*:*:*:*before f.48VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_245_g1:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_1000-1300_firmware:*:*:*:*:*:*:*:*before f.48VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_1000-1300:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_250_g1_notebook_pc_firmware:*:*:*:*:*:*:*:*before f.47VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_250_g1_notebook_pc:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_255_g1_notebook_pc_firmware:*:*:*:*:*:*:*:*before f.47VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_255_g1_notebook_pc:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hp:hp_envy_15-j000_firmware:*:*:*:*:*:*:*:*before f.22VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_15-j000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_15-j100_firmware:*:*:*:*:*:*:*:*before f.71VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_15-j100:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_15-n000_firmware:*:*:*:*:*:*:*:*before f.72VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_15-n000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_246_firmware:*:*:*:*:*:*:*:*before f.04VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_246:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_455_firmware:*:*:*:*:*:*:*:*before f.08VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_455:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_17_j100_firmware:*:*:*:*:*:*:*:*before f.71VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_17_j100:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_17-j100_leap_motion_se_firmware:*:*:*:*:*:*:*:*before f.71VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_17-j100_leap_motion_se:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_split_13-g200_firmware:*:*:*:*:*:*:*:*before f.25VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_split_13-g200:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_100_firmware:*:*:*:*:*:*:*:*before f.22VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_100:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_14-n000_firmware:*:*:*:*:*:*:*:*before f.72VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_14-n000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_14-k100_firmware:*:*:*:*:*:*:*:*before f.22VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_14-k100:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_spectre_x2_13-smb_pro_firmware:*:*:*:*:*:*:*:*before f.25VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_spectre_x2_13-smb_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_spectre_13-h200_firmware:*:*:*:*:*:*:*:*before f.25VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_spectre_13-h200:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_15-n200_firmware:*:*:*:*:*:*:*:*before f.72VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_15-n200:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_15-n300_firmware:*:*:*:*:*:*:*:*before f.72VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_15-n300:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_envy_m6-n000_firmware:*:*:*:*:*:*:*:*before f.26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_envy_m6-n000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_255_g3_firmware:*:*:*:*:*:*:*:*before f.45VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_255_g3:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_14-g000_firmware:*:*:*:*:*:*:*:*before f.45VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_14-g000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_11-n000_firmware:*:*:*:*:*:*:*:*before f.2eVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_11-n000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_15-r000_firmware:*:*:*:*:*:*:*:*before f.43VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_15-r000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_15-r500_firmware:*:*:*:*:*:*:*:*before f.43VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_15-r500:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_pavilion_10-f000_firmware:*:*:*:*:*:*:*:*before f.0eVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_pavilion_10-f000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_g14-a000_firmware:*:*:*:*:*:*:*:*before f.06VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_g14-a000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_14-r000_firmware:*:*:*:*:*:*:*:*before f.43VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_14-r000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_240_g3_firmware:*:*:*:*:*:*:*:*before f.43VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_240_g3:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:hp_246_g3_firmware:*:*:*:*:*:*:*:*before f.43VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:hp_246_g3:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:compaq_cq45-900_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:compaq_cq45-900:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:compaq_14-h000_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:compaq_14-h000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:compaq_14-s000_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:compaq_14-s000:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2751
  2. 2026-10-03 Alias added: GHSA-82wv-qvfh-pqc2

References

Advisory 1

Sources