Serious vulnerabilities in HP devices left unpatched for months on end TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Serious vulnerabilities in HP devices left unpatched for months on end By Sead Fadilpašić published 12 September 2022 Security flaws allow for arbitrary code execution (Image credit: Pixabay) Audio player loading… Multiple high-severity vulnerabilities affecting a number of HP business notebooks (opens in new tab), business desktop PCs (opens in new tab), point of sale systems, and workstations (opens in new tab), have been sitting unpatched for months on end, researchers have warned. This could mean countless HP users are at risk of having their endpoints broken, their files stolen, or their digital accounts compromised, as all of the flaws found allow for arbitrary code execution. What's more, as the flaws are in the firmware, they can persist even after reinstalling the operating system, experts have warned. Partial fix According to Binarly, the company found a total of six vulnerabilities - three in July 2021 and three more in April 2022, all of which are System Management Module (SMM) memory corruption vulnerabilities. The flaws are tracked as CVE-2022-23930 (8.2), CVE-2022-31644 (7.5), CVE-2022-31645 (8.2), CVE-2022-31646 (8.2), CVE-2022-31640 (7.5), and CVE-2022-31641 (7.5). Since the disclosure, HP has published three security advisories for three of the flaws, and pushed three BIOS updates, fixing the flaws on some of the models. However, the company has failed to release any patches for the devices in Elite, Zbook, or ProBook series, as well as for ProDesk, EliteDesk, and ProOne series. HP workstations, including Z1, Z2, Z4, and Zcentral, are also still vulnerable to the flaws. Read more> HP's most annoying bloatware has a serious security flaw > Your HP printer could be facing the risk of a serious cyberattack > Best cloud backup right now Even though Binarly warned of the potential risk associated with not having patches for these flaws, the company did stress the difficulties that come with fixing vulnerabilities for a single vendor. "As a result of the complexity of the firmware supply chain, there are gaps that are difficult to close on the manufacturing end since it involves issues beyond the control of the device vendors," it said in its report. TechRadar Pro has reached out to HP for a comment on when it plans on releasing fixes for the affected devices, and will update the article if we receive a reply.These are the best patch management software (opens in new tab) options around right now Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie3Google Pixel Tablet is what Apple should've done ages ago4RTX 4090 too expensive? Nvidia resurrects another old favorite5More than one million credit card details leaked online1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2iPhone 15 tipped to come with an upgraded 5G chip3If this feature succeeds for Modern Warfare 2, Microsoft can't ignore it4Apple October launches: the new devices we might see this month5The Rings of Power episode 8 trailer feels like one big Sauron misdirect Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab) Other versions of this page are available with specific content for the following regions:Sverige