CVE-2019-6321 - HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled

Back Back to CVE browser

HIGH

HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled

Published May 29, 2019

7.2

HIGH

CVSS 3.0

EPSS 1.43%

Description

HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled by default.

Affected products

Vendor n/a Product HP Z4 G4 Core-X Workstation Default
n/a
- Version
  before 1.70
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z4 G4 Core-X Workstation (Linux) Default
n/a
- Version
  before 1.70
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z4 G4 Workstation (Xeon W) Default
n/a
- Version
  before 1.70
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z4 G4 Workstation (Xeon W) (Linux) Default
n/a
- Version
  before 1.70
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z6 G4 Workstation Default
n/a
- Version
  before 1.71
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z6 G4 Workstation (Linux) Default
n/a
- Version
  before 1.71
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z8 G4 Workstation Default
n/a
- Version
  before 1.71
  Status
  affected
  Constraints
  -
Vendor n/a Product HP Z8 G4 Workstation (Linux) Default
n/a
- Version
  before 1.71
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

HP Z4 G4 Core-X Workstation

n/a

Version	Status	Constraints
before 1.70	affected	-

n/a

HP Z4 G4 Core-X Workstation (Linux)

n/a

Version	Status	Constraints
before 1.70	affected	-

n/a

HP Z4 G4 Workstation (Xeon W)

n/a

Version	Status	Constraints
before 1.70	affected	-

n/a

HP Z4 G4 Workstation (Xeon W) (Linux)

n/a

Version	Status	Constraints
before 1.70	affected	-

n/a

HP Z6 G4 Workstation

n/a

Version	Status	Constraints
before 1.71	affected	-

n/a

HP Z6 G4 Workstation (Linux)

n/a

Version	Status	Constraints
before 1.71	affected	-

n/a

HP Z8 G4 Workstation

n/a

Version	Status	Constraints
before 1.71	affected	-

n/a

HP Z8 G4 Workstation (Linux)

n/a

Version	Status	Constraints
before 1.71	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-667

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15886
Advisory
https://support.hp.com/us-en/document/c06318199
vendor-advisoryx_refsource_HPPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15886		Advisory
https://support.hp.com/us-en/document/c06318199		vendor-advisoryx_refsource_HPPatchVendor Advisory