CVE-2023-5410: HP PC BIOS Memory Tampering Vulnerability

CVE-2023-5410 Overview

CVE-2023-5410 affects the system Basic Input/Output System (BIOS) of certain HP PC products. HP disclosed that the flaw might allow memory tampering by a local attacker with high privileges. The weakness is categorized under [CWE-203] Observable Discrepancy, indicating an information channel that can be abused to influence firmware-level memory operations. HP has released mitigation guidance for affected platforms through its security advisory.

Critical Impact
A local attacker with high privileges can tamper with BIOS memory, undermining confidentiality, integrity, and availability of the underlying platform and crossing into firmware trust boundaries.

Affected Products

HP PC products with affected system BIOS firmware (see HP advisory for the model list)
HP commercial and consumer notebook and desktop platforms identified by HP
HP workstation systems listed in advisory HPSBHF03924

Discovery Timeline

2024-03-12 - CVE-2023-5410 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2023-5410

Vulnerability Analysis

The vulnerability resides in the system BIOS of affected HP PC products. According to HP, the weakness might allow memory tampering at the firmware level. Firmware-level memory tampering can subvert pre-boot security controls, modify protected regions, or influence operating system load behavior.

The weakness is mapped to [CWE-203] Observable Discrepancy. This class of flaw exposes differences in behavior or response that an attacker can measure to infer protected state or to drive subsequent tampering actions. Combined with the local attack vector and the requirement for high privileges, the issue represents a privileged firmware escalation path rather than a remote exploitation primitive.

The scope is marked as changed in the CVSS vector, meaning successful exploitation can affect resources beyond the BIOS component itself. This typically indicates that compromise of the firmware boundary can impact the operating system, hypervisor, or other trust domains running on the platform.

Root Cause

HP attributes the issue to a flaw in the system BIOS that does not adequately prevent memory tampering. The CWE-203 mapping suggests that observable behavioral or timing differences in BIOS routines provide signals an attacker can exploit to manipulate protected memory regions.

Attack Vector

Exploitation requires local access to the device and high privileges on the running operating system. An attacker meeting these prerequisites can interact with BIOS interfaces and trigger the conditions necessary to tamper with memory. No user interaction is required. Because the attack relies on local privileged execution, it is most relevant in post-compromise scenarios, insider threat models, and physical access attacks against high-value endpoints.

No public proof-of-concept exploit, ExploitDB entry, or Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) listing is associated with this CVE at the time of writing.

No verified code examples are available for this issue. Refer to the HP Security Advisory for vendor-specific technical details and firmware update guidance.

Detection Methods for CVE-2023-5410

Indicators of Compromise

Unexpected modifications to BIOS configuration, secure boot keys, or platform firmware variables that do not align with authorized change windows.
Discrepancies between measured boot Platform Configuration Register (PCR) values reported by the Trusted Platform Module (TPM) and known-good baselines.
Firmware version strings that do not match the HP-published fixed BIOS revision after a scheduled patch deployment.

Detection Strategies

Inventory BIOS versions across the fleet and compare them against HP's fixed releases listed in advisory HPSBHF03924.
Monitor for local privilege escalation activity preceding firmware interaction, since exploitation requires high local privileges.
Collect and analyze TPM event logs and measured boot data to identify unauthorized firmware-level changes.

Monitoring Recommendations

Forward endpoint, identity, and firmware telemetry to a centralized analytics platform to correlate privileged process execution with BIOS access events.
Alert on administrative use of BIOS update utilities, WMI firmware interfaces, and vendor management tools outside change windows.
Track reboot patterns followed by firmware version changes to detect tampering attempts that survive operating system reinstallation.

How to Mitigate CVE-2023-5410

Immediate Actions Required

Apply the BIOS update published by HP in advisory HPSBHF03924 to all affected models as soon as testing permits.
Restrict local administrator and SYSTEM privileges, since exploitation requires high local privileges on the host.
Enforce full disk encryption and pre-boot authentication to raise the cost of physical and local attacks against firmware.

Patch Information

HP has released firmware mitigation for the affected products. Administrators should consult the HP Security Advisory for the specific BIOS revisions that address CVE-2023-5410 and apply them through HP's supported update mechanisms.

Workarounds

Limit the number of accounts with local administrative rights on affected HP endpoints to reduce the population of users who meet the privilege prerequisite.
Enable BIOS administrator passwords and Secure Boot to harden firmware configuration interfaces against unauthorized changes.
Use measured boot with TPM attestation to detect firmware tampering even when patching cannot be performed immediately.

bash

# Configuration example: verify BIOS version on Windows endpoints
wmic bios get smbiosbiosversion,manufacturer,releasedate

# Linux equivalent using dmidecode
sudo dmidecode -s bios-version
sudo dmidecode -s bios-release-date