Is CVE-2019-18913 in the CISA KEV catalog?

No. CVE-2019-18913 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2019-18913?

CVE-2019-18913 has a CVSS v3 base score of 6.8 (MEDIUM).

What is the EPSS score for CVE-2019-18913?

CVE-2019-18913 has an EPSS score of 0.60% (45th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2019-18913?

Upgrade elite dragonfly firmware to 01.04.02 or later. Fixes are available for 33 affected products.

CVE & CISA-KEV Catalog

CVE-2019-18913

MEDIUM

6.8

CVSS v3

NVD

Description

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

How to fix

Remediation Available

elite dragonfly firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elite x2 g4 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 830 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 836 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 840 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 840 g6 healthcare edition firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 846 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 846 g6 healthcare edition firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook 850 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook x360 1030 g4 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook x360 1040 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitebook x360 830 g6 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

elitedesk 800 g5 dm firmwareNVD

Affected:< 02.04.02Fixed in:02.04.02CVE-2019-18913derived from NVD

elitedesk 800 g5 sff firmwareNVD

Affected:< 02.04.02Fixed in:02.04.02CVE-2019-18913derived from NVD

elitedesk 800 g5 twr firmwareNVD

Affected:< 02.04.02Fixed in:02.04.02CVE-2019-18913derived from NVD

eliteone 800 g5 aio firmwareNVD

Affected:< 02.04.02Fixed in:02.04.02CVE-2019-18913derived from NVD

probook 640 g5 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

probook 650 g5 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

prodesk 400 g5 dm firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 400 g6 mt firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 400 g6 sff firmwareNVD

Affected:< 02.04.02Fixed in:02.04.02CVE-2019-18913derived from NVD

prodesk 480 g6 mt firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 600 g5 dm firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 600 g5 mt firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 600 g5 pci mt firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

prodesk 600 g5 sff firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

proone 400 g5 aio firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

proone 440 g5 aio firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

proone 600 g5 aio firmwareNVD

Affected:< 02.04.01Fixed in:02.04.01CVE-2019-18913derived from NVD

zbook 14u g6 mobile workstation firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

zbook 15u g6 mobile workstation firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

zbook 17u g6 mobile workstation firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

zhan x 13 g2 firmwareNVD

Affected:< 01.04.02Fixed in:01.04.02CVE-2019-18913derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

0.60%probability of exploitation in 30 days

45thpercentile

Moderate risk: more likely to be exploited than 45% of all known CVEs.

References

Patch1

support.hp.com

Embed a live status badge for CVE-2019-18913

Markdown

[![CVE-2019-18913](https://tridentstack.com/cve/badge/CVE-2019-18913.svg)](https://tridentstack.com/cve/CVE-2019-18913)

HTML

<a href="https://tridentstack.com/cve/CVE-2019-18913"><img src="https://tridentstack.com/cve/badge/CVE-2019-18913.svg" alt="CVE-2019-18913"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.