CVE-2019-18913: HP Elite Dragonfly Firmware

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

Affected products

• HP Elite Dragonfly Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elite x2 g4 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 830 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 836 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 840 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 840 g6 Healthcare Edition Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 846 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 846 g6 Healthcare Edition Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook 850 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook x360 1030 g4 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook x360 1040 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitebook x360 830 g6 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Elitedesk 800 g5 Dm Firmware: before 02.04.02 (fixed in 02.04.02)
• HP Elitedesk 800 g5 Sff Firmware: before 02.04.02 (fixed in 02.04.02)
• HP Elitedesk 800 g5 Twr Firmware: before 02.04.02 (fixed in 02.04.02)
• HP Eliteone 800 g5 Aio Firmware: before 02.04.02 (fixed in 02.04.02)
• HP Probook 640 g5 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Probook 650 g5 Firmware: before 01.04.02 (fixed in 01.04.02)
• HP Prodesk 400 g5 Dm Firmware: before 02.04.01 (fixed in 02.04.01)
• HP Prodesk 400 g6 Mt Firmware: before 02.04.01 (fixed in 02.04.01)
• HP Prodesk 400 g6 Sff Firmware: before 02.04.02 (fixed in 02.04.02)
• HP Prodesk 480 g6 Mt Firmware: before 02.04.01 (fixed in 02.04.01)
• HP Prodesk 600 g5 Dm Firmware: before 02.04.01 (fixed in 02.04.01)
• HP Prodesk 600 g5 Mt Firmware: before 02.04.01 (fixed in 02.04.01)
• HP Prodesk 600 g5 Pci Mt Firmware: before 02.04.01 (fixed in 02.04.01)
• and 8 more

Published 2020-01-31. Last modified 2026-06-17.