HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI…
Priority LOW 35CWE-667Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-667 and the CVSS impact.
Summary
HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled by default.
Why it matters now
EPSS 0.01425 73rd percentileScored 2026-11-07
Fix Fixed HP Z4 G4 Workstation (Xeon W): 1.70HP Z4 G4 Workstation (Xeon W) (Linux): 1.70+6 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HP Z4 G4 Workstation (Xeon W) | before 1.70 | 1.70 | Patch available | CNA |
| — | HP Z4 G4 Workstation (Xeon W) (Linux) | before 1.70 | 1.70 | Patch available | CNA |
| — | HP Z4 G4 Core-X Workstation | before 1.70 | 1.70 | Patch available | CNA |
| — | HP Z4 G4 Core-X Workstation (Linux) | before 1.70 | 1.70 | Patch available | CNA |
| — | HP Z6 G4 Workstation | before 1.71 | 1.71 | Patch available | CNA |
| — | HP Z6 G4 Workstation (Linux) | before 1.71 | 1.71 | Patch available | CNA |
| — | HP Z8 G4 Workstation | before 1.71 | 1.71 | Patch available | CNA |
| — | HP Z8 G4 Workstation (Linux) | before 1.71 | 1.71 | Patch available | CNA |
- HP Z4 G4 Workstation (Xeon W) Vendor— Affected before 1.70 Fixed in 1.70 Patch available CNA
- HP Z4 G4 Workstation (Xeon W) (Linux) Vendor— Affected before 1.70 Fixed in 1.70 Patch available CNA
- HP Z4 G4 Core-X Workstation Vendor— Affected before 1.70 Fixed in 1.70 Patch available CNA
- HP Z4 G4 Core-X Workstation (Linux) Vendor— Affected before 1.70 Fixed in 1.70 Patch available CNA
- HP Z6 G4 Workstation Vendor— Affected before 1.71 Fixed in 1.71 Patch available CNA
- HP Z6 G4 Workstation (Linux) Vendor— Affected before 1.71 Fixed in 1.71 Patch available CNA
- HP Z8 G4 Workstation Vendor— Affected before 1.71 Fixed in 1.71 Patch available CNA
- HP Z8 G4 Workstation (Linux) Vendor— Affected before 1.71 Fixed in 1.71 Patch available CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:z4_g4_workstation_firmware:*:*:*:*:*:*:*:* | before 1.70 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:z4_g4_workstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z4_g4_core-x_workstation_firmware:*:*:*:*:*:*:*:* | before 1.70 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:z4_g4_core-x_workstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:*:*:* | before 1.71 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:z6_g4_workstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:*:*:* | before 1.71 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:z8_g4_workstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z4_g4_workstation_firmware:*:*:*:*:*:linux:*:* | before 1.70 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z4_g4_core-x_workstation_firmware:*:*:*:*:*:linux:*:* | before 1.70 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:z4_g4_workstation_firmware:*:*:*:*:*:*:*:* Versions before 1.70 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:z4_g4_workstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z4_g4_core-x_workstation_firmware:*:*:*:*:*:*:*:* Versions before 1.70 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:z4_g4_core-x_workstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:*:*:* Versions before 1.71 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:z6_g4_workstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:*:*:* Versions before 1.71 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:z8_g4_workstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z4_g4_workstation_firmware:*:*:*:*:*:linux:*:* Versions before 1.70 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z4_g4_core-x_workstation_firmware:*:*:*:*:*:linux:*:* Versions before 1.70 Vulnerable ·Hewlett Packard Enterprise
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:linux:*:* | before 1.71 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:linux:*:* | before 1.71 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:linux:*:* Versions before 1.71 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:linux:*:* Versions before 1.71 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA HP Z4 G4 Workstation (Xeon W) Fixed in 1.70
- Fix · CNA HP Z4 G4 Workstation (Xeon W) (Linux) Fixed in 1.70
- Fix · CNA HP Z4 G4 Core-X Workstation Fixed in 1.70
- Fix · CNA HP Z4 G4 Core-X Workstation (Linux) Fixed in 1.70
- Fix · CNA HP Z6 G4 Workstation Fixed in 1.71
- Fix · CNA HP Z6 G4 Workstation (Linux) Fixed in 1.71
- Fix · CNA HP Z8 G4 Workstation Fixed in 1.71
- Fix · CNA HP Z8 G4 Workstation (Linux) Fixed in 1.71
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
HP Z4 G4 Core-X Workstation, HP Z4 G4 Core-X Workstation (Linux) and 6 more products — HPSBHF03614
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-04488 HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI…Priority LOW 32
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6321
- 2026-10-03 Alias added: GHSA-9c6c-jqh5-vqv4
References
Patch 1
More Hewlett Packard Enterprise Z4 G4 Core-x Workstation Firmware vulnerabilities
- TI-2019-04488 HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI… CVSS 3.0MEDIUM 6.8
Sources
- CVE-2019-6321 · CVE Program
- CVE-2019-6321 · NVD
- FIRST EPSS
- GHSA-9c6c-jqh5-vqv4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences