CVE-2017-2751: HP Compaq 14-h000 Firmware

Medium severity, CVSS 4.6. EPSS: 1.1% chance of exploitation in the next 30 days.

A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.

Affected products

• HP Compaq 14-h000 Firmware: affected versions not specified
• HP Compaq 14-s000 Firmware: affected versions not specified
• HP Compaq CQ45-900 Firmware: affected versions not specified
• HP HP 1000-1300 Firmware: before f.48 (fixed in f.48)
• HP HP 14-g000 Firmware: before f.45 (fixed in f.45)
• HP HP 14-r000 Firmware: before f.43 (fixed in f.43)
• HP HP 15-r000 Firmware: before f.43 (fixed in f.43)
• HP HP 15-r500 Firmware: before f.43 (fixed in f.43)
• HP HP 240 g1 Firmware: before f.48 (fixed in f.48)
• HP HP 240 g3 Firmware: before f.43 (fixed in f.43)
• HP HP 245 g1 Firmware: before f.48 (fixed in f.48)
• HP HP 246 Firmware: before f.04 (fixed in f.04)
• HP HP 246 g3 Firmware: before f.43 (fixed in f.43)
• HP HP 250 g1 Notebook Pc Firmware: before f.47 (fixed in f.47)
• HP HP 255 g1 Notebook Pc Firmware: before f.47 (fixed in f.47)
• HP HP 255 g3 Firmware: before f.45 (fixed in f.45)
• HP HP 455 Firmware: before f.08 (fixed in f.08)
• HP HP Envy 100 Firmware: before f.22 (fixed in f.22)
• HP HP Envy 14-k100 Firmware: before f.22 (fixed in f.22)
• HP HP Envy 15-j000 Firmware: before f.22 (fixed in f.22)
• HP HP Envy 15-j100 Firmware: before f.71 (fixed in f.71)
• HP HP Envy 17-j100 Leap Motion SE Firmware: before f.71 (fixed in f.71)
• HP HP Envy 17 j100 Firmware: before f.71 (fixed in f.71)
• HP HP Envy m6-n000 Firmware: before f.26 (fixed in f.26)
• HP HP g14-a000 Firmware: before f.06 (fixed in f.06)
• and 9 more

Published 2018-10-03. Last modified 2026-06-17.