CVE-2023-26299: HP 200 g3 Firmware

High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days.

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

Affected products

• HP 200 g3 Firmware: affected versions not specified
• HP 200 g4 22 All-In-One Firmware: affected versions not specified
• HP 200 Pro g4 22 All-In-One Firmware: affected versions not specified
• HP 205 g4 22 All-In-One Firmware: affected versions not specified
• HP 205 Pro g4 22 All-In-One Firmware: affected versions not specified
• HP 240 g10 Firmware: before f.04 (fixed in f.04)
• HP 245 g6 Firmware: before f.35 (fixed in f.35)
• HP 245 g7 Firmware: before f.69 (fixed in f.69)
• HP 245 g8 Firmware: before f.25 (fixed in f.25)
• HP 247 g8 Firmware: before f.69 (fixed in f.69)
• HP 250 g10 Firmware: before f.05 (fixed in f.05)
• HP 255 g10 Firmware: before f.08 (fixed in f.08)
• HP 260 g4 Desktop Mini Firmware: before 2.14 (fixed in 2.14)
• HP 280 g3 Firmware: affected versions not specified
• HP 280 g4 Firmware: affected versions not specified
• HP 280 g4 Microtower Firmware: affected versions not specified
• HP 280 g5 Firmware: affected versions not specified
• HP 280 g5 Small Form Factor Firmware: affected versions not specified
• HP 280 g6 Firmware: affected versions not specified
• HP 280 g8 Microtower Firmware: affected versions not specified
• HP 280 Pro g3 Firmware: affected versions not specified
• HP 280 Pro g4 Microtower Firmware: affected versions not specified
• HP 280 Pro g5 Small Form Factor Firmware: affected versions not specified
• HP 282 g5 Firmware: affected versions not specified
• HP 282 g6 Firmware: affected versions not specified
• and 34 more

Published 2023-06-30. Last modified 2026-06-17.