CVE-2021-39301: HP Z1 G5 Privilege Escalation Vulnerability

CVE-2021-39301 Overview

CVE-2021-39301 affects the UEFI firmware (BIOS) shipped with a broad range of HP PC products, including EliteBook, ProBook, ZBook, EliteDesk, ProDesk, EliteOne, ProOne, and Z-series workstations. The vulnerability allows an attacker with local, low-privileged access to escalate privileges and execute arbitrary code within the firmware execution context.

Because the flaw resides below the operating system in UEFI, successful exploitation can persist across OS reinstallation and undermine standard endpoint defenses. HP published advisory ish_5661066-5661090-16 to coordinate firmware updates across affected models.

Critical Impact
An authenticated local attacker can escalate privilege and execute arbitrary code in the UEFI firmware, enabling persistent, OS-level evasion and full compromise of confidentiality, integrity, and availability on hundreds of HP commercial PC models.

Affected Products

HP EliteBook, ProBook, ZBook, and Elite Dragonfly notebook firmware (multiple generations, G1 through G8)
HP EliteDesk, ProDesk, EliteOne, ProOne, and Z-series workstation firmware (G3 through G8)
HP Engage Flex Mini Retail System and MP9 G4 Retail System firmware

Discovery Timeline

2022-02-16 - CVE-2021-39301 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-39301

Vulnerability Analysis

CVE-2021-39301 is a UEFI/BIOS firmware vulnerability that enables local privilege escalation and arbitrary code execution. The flaw exists in firmware components common to a large catalog of HP commercial PCs. Exploitation requires local access with low privileges and no user interaction, and the scope changes during exploitation, indicating the attacker can break out of the initial execution context to affect resources beyond it.

Firmware-level execution sits below the operating system and below most security controls. An attacker who succeeds at the UEFI layer can manipulate boot flow, disable or bypass Secure Boot, install a bootkit, or hide implants in System Management Mode (SMM). This category of flaw is tracked by NVD under NVD-CWE-noinfo because HP did not disclose the specific weakness class.

Root Cause

HP described the issue as a set of potential vulnerabilities in the UEFI firmware (BIOS) of affected PC products. The vendor advisory does not enumerate the precise weakness, but the impact profile, local vector, low privilege requirement, and changed scope, is consistent with firmware components that accept attacker-controlled input from the OS (for example through SMI handlers or NVRAM variables) without sufficient validation.

Attack Vector

The attacker must already have code execution on the target host with low privileges. From that position, the attacker invokes the vulnerable firmware interface to escalate into a higher firmware privilege context. From there, arbitrary code execution is possible at a layer where standard OS-resident defenses have no visibility.

No public proof-of-concept code, exploit database entry, or CISA KEV listing is associated with this CVE. The vulnerability is not known to be exploited in the wild. See the HP Support Document for vendor-provided technical context.

Detection Methods for CVE-2021-39301

Indicators of Compromise

Unexpected changes to UEFI variables, Boot Order entries, or Secure Boot configuration on affected HP systems
Firmware version strings that do not match the patched release listed in HP advisory ish_5661066-5661090-16
Presence of unsigned or unknown DXE drivers and SMM modules captured during firmware integrity scans

Detection Strategies

Inventory firmware versions across the fleet and compare against HP's fixed BIOS releases for each model line
Use UEFI integrity tooling such as CHIPSEC or vendor measured-boot attestation to validate SPI flash contents and SMM modules
Monitor for local privilege-escalation precursors, including suspicious driver loads and tools that interact with \\.\PhysicalMemory or MSR-access utilities

Monitoring Recommendations

Forward TPM PCR values and Windows Measured Boot logs to a central analytics platform to identify drift in boot-time measurements
Alert on firmware update events outside approved maintenance windows and correlate with local-admin authentication activity
Track firmware compliance posture as an ongoing KPI tied to the HP advisory rather than a one-time remediation task

How to Mitigate CVE-2021-39301

Immediate Actions Required

Apply the BIOS update referenced in HP advisory ish_5661066-5661090-16 to every affected model in the environment
Restrict local administrator rights and require multi-factor authentication for privileged accounts to reduce the pool of users that can stage local exploitation
Enable Secure Boot, BIOS administrator password protection, and HP Sure Start where supported to harden the firmware attack surface

Patch Information

HP has released updated UEFI firmware (BIOS) for the affected commercial PC models. Refer to the HP Support Document for the per-model minimum fixed BIOS version. Deploy updates using HP Image Assistant, HP Manageability Integration Kit, or your standard enterprise firmware deployment tooling, and verify the post-update BIOS version on each endpoint.

Workarounds

No software workaround replaces firmware patching; minimize exposure by enforcing least privilege on all endpoints until BIOS updates are deployed
Disable unused firmware interfaces and external boot options through BIOS policy to reduce avenues for local manipulation
Physically secure devices and disable unattended local logins on shared or kiosk systems running affected firmware

bash

# Example: query installed BIOS version on Windows to confirm patch deployment
wmic bios get smbiosbiosversion,manufacturer,releasedate

# Example: query installed BIOS version on Linux
sudo dmidecode -s bios-version
sudo dmidecode -s bios-release-date