CVE-2017-2751: hp inc. hp 240 g1 notebook pc and certain other consumer notebooks Insufficiently Protected Credentials

Vulnerability summary

CVE-2017-2751 is a medium (CVSS 4.6) Insufficiently Protected Credentials vulnerability in hp inc. hp 240 g1 notebook pc and certain other consumer notebooks. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 64.3% of scored vulnerabilities.

Timeline

1. 03-10-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.