Read the docs
TI-2021-02603 Aliases CVE-2021-3661GHSA-8r2c-p9ww-m55w

Code injection in Hewlett Packard Enterprise HP Workstation BIOS

Priority LOW 38CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code execution. HP is releasing firmware mitigations for the potential vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hewlett Packard EnterpriseHP Workstation BIOSSee HP Security Bulletin reference for affected versions.—No fix listedCNA
  • HP Workstation BIOS VendorHewlett Packard Enterprise Affected See HP Security Bulletin reference for affected versions. Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:o:hp:z1_all-in-one_g3_firmware:01.31:*:*:*:*:*:*:*01.31VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z1_all-in-one_g3:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_mini_g3_firmware:01.83:*:*:*:*:*:*:*01.83VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_mini_g3:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_mini_g4_firmware:01.08.01:*:*:*:*:*:*:*01.08.01VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_mini_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_mini_g5_firmware:01.03.00_rev_a:*:*:*:*:*:*:*01.03.00_rev_aVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_mini_g5:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_small_form_factor_g4_firmware:01.08.01:*:*:*:*:*:*:*01.08.01VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_small_form_factor_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hp:z2_small_form_factor_g5_firmware:01.03.00_rev_a:*:*:*:*:*:*:*01.03.00_rev_aVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_small_form_factor_g5:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_small_form_factor_g8_firmware:01.03.00_rev_a:*:*:*:*:*:*:*01.03.00_rev_aVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_small_form_factor_g8:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_tower_g4_firmware:01.08.01:*:*:*:*:*:*:*01.08.01VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_tower_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_tower_g5_firmware:01.03.00_rev_a:*:*:*:*:*:*:*01.03.00_rev_aVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_tower_g5:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z2_tower_g8_firmware:01.03.00_rev_a:*:*:*:*:*:*:*01.03.00_rev_aVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z2_tower_g8:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z238_microtower_firmware:01.83:*:*:*:*:*:*:*01.83VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z238_microtower:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z240_small_form_factor_firmware:01.83:*:*:*:*:*:*:*01.83VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z240_small_form_factor:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z240_tower_firmware:01.83:*:*:*:*:*:*:*01.83VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z240_tower:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z4_g4_firmware:02.75:*:*:*:*:*:*:*02.75VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z4_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z440_firmware:2.58:*:*:*:*:*:*:*2.58VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z440:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z6_g4_firmware:02.75:*:*:*:*:*:*:*02.75VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z6_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z640_firmware:2.58:*:*:*:*:*:*:*2.58VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z640:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z8_g4_firmware:02.75:*:*:*:*:*:*:*02.75VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z8_g4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:z840_firmware:2.58:*:*:*:*:*:*:*2.58VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:z840:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:zcentral_4r_firmware:01.18:*:*:*:*:*:*:*01.18VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:zcentral_4r:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3661
  2. 2026-10-03 Alias added: GHSA-8r2c-p9ww-m55w

References

Advisory 1

  • TI-2021-02403 Improper privilege management in Hewlett Packard Enterprise HP PC BIOS CVSS 3.1HIGH 7.8
  • TI-2022-13563 Time-of-check time-of-use race condition in Hewlett Packard Enterprise HP PC BIOS CVSS 3.1HIGH 7.0
  • TI-2022-13562 Time-of-check time-of-use race condition in Hewlett Packard Enterprise HP PC BIOS CVSS 3.1HIGH 7.0
  • TI-2022-13561 Time-of-check time-of-use race condition in Hewlett Packard Enterprise HP PC BIOS CVSS 3.1HIGH 7.0
  • TI-2022-10543 Time-of-check time-of-use race condition in Hewlett Packard Enterprise HP PC BIOS CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences