high
7.2
Advisory Published
Updated

CVE-2019-18913

First published: Fri Jan 31 2020(Updated: )

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

Credit: hp-security-alert@hp.com

Affected SoftwareAffected VersionHow to fix
HP EliteDesk 800 G5 Desktop Mini Firmware<02.04.02
HP EliteDesk 800 G5 Desktop Mini
HP EliteDesk 800 G5 SFF Firmware<02.04.02
HP EliteDesk 800 G5 SFF Firmware
HP EliteDesk 800 G5 Tower Firmware<02.04.02
HP EliteDesk 800 G5 TWR Firmware
HP EliteOne 800 G5 AIO Firmware<02.04.02
HP EliteOne 800 G5 AIO Firmware
HP ProDesk 400 G5 Firmware<02.04.01
HP ProDesk 400 G5 DM Firmware
HP ProDesk 400 G6 Firmware<02.04.01
HP ProDesk 400 G6 MT Firmware
HP ProDesk 400 G6 Firmware<02.04.02
HP ProDesk 400 G6 SFF Firmware
HP Prodesk 480 G6 Firmware<02.04.01
HP ProDesk 480 G6
HP ProDesk 600 G5 Firmware<02.04.01
HP ProDesk 600 G5 DM Firmware
HP ProDesk 600 G5 Firmware<02.04.01
HP ProDesk 600 G5
HP ProDesk 600 G5 PCI MT Firmware<02.04.01
HP ProDesk 600 G5 PCI MT Firmware
HP ProDesk 600 G5 Firmware<02.04.01
HP ProDesk 600 G5 SFF Firmware
HP ProOne 400 G5 AIO<02.04.01
HP ProOne 400 G5 AIO Firmware
HP ProOne 440 G5 Firmware<02.04.01
HP ProOne 440 G5
HP ProOne 600 G5 All-in-One Firmware<02.04.01
HP ProOne 600 G5 All-in-One Firmware
HP Elite Dragonfly Firmware<01.04.02
HP Elite Dragonfly
HP Elite x2 G4<01.04.02
HP Elite x2 G4 Firmware
HP EliteBook x360 830 G6 Firmware<01.04.02
HP EliteBook 830 G6 Firmware
HP EliteBook 836 G6 Firmware<01.04.02
HP EliteBook 836 G6 Firmware
HP EliteBook 840 G6 Firmware<01.04.02
HP EliteBook 840 G6 Firmware
HP EliteBook 840 G6 Healthcare Edition Firmware<01.04.02
HP EliteBook 840 G6 Healthcare Edition Firmware
HP EliteBook 846 G6 Firmware<01.04.02
HP EliteBook 846 G6 Firmware
HP EliteBook 846 G6 Healthcare Edition Firmware<01.04.02
HP EliteBook 846 G6 Healthcare Edition Firmware
HP EliteBook 850 G6 Firmware<01.04.02
HP EliteBook 850 G6 Firmware
HP EliteBook x360 1030 G4<01.04.02
HP EliteBook x360 1030 G4 Firmware
HP EliteBook x360 1040 G6<01.04.02
HP EliteBook x360 1040 G6
HP EliteBook x360 830 G6 Firmware<01.04.02
HP EliteBook x360 830 G6 Firmware
HP ProBook 640 G5<01.04.02
HP ProBook 640 G5 Firmware
HP ProBook 650 G5 Firmware<01.04.02
HP ProBook 650 G5 Firmware
HP ZBook 14u G6 Mobile Workstation Firmware<01.04.02
HP ZBook 14u G6 Mobile Workstation Firmware
HP ZBook 15u G6 Mobile Workstation<01.04.02
HP ZBook 15u G6
HP Zhan X 13 G2 Firmware<01.04.02
HP Zhan X 13 G2 Firmware
HP ZBook 17u G6 Mobile Workstation Firmware<01.04.02
HP ZBook 17u G6 Mobile Workstation Firmware

Remedy

https://support.hp.com/us-en/document/c06549501

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2019-18913?

    CVE-2019-18913 is considered a critical security vulnerability due to its potential for unauthorized UEFI code execution.

  • How do I fix CVE-2019-18913?

    To fix CVE-2019-18913, update the UEFI firmware to the latest version provided by HP.

  • Which products are affected by CVE-2019-18913?

    CVE-2019-18913 affects multiple HP models including EliteDesk, ProDesk, EliteOne, and ZBook series with specific firmware versions.

  • What type of attack does CVE-2019-18913 facilitate?

    CVE-2019-18913 enables open-case physical attacks that could allow unauthorized access to UEFI firmware.

  • Is it safe to leave systems vulnerable to CVE-2019-18913?

    Leaving systems vulnerable to CVE-2019-18913 poses significant security risks, including potential remote code execution.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203