CVE-2022-23953: Jupyter Notebook firmware flaw

CISO Take

CVE-2022-23953 is an unscored BIOS vulnerability in some HP ProBook 440 G8 and ProDesk 405 G6 PCs that can cause denial of service. It has no CVSS rating, no CWE, and no attack vector details. The EPSS score is 0.00256, though that sits in the top 84% by percentile. It is not in CISA KEV, has no public exploit, and no Nuclei template. The tracked 'package' mapping (pip, 3,047 dependents) looks like a data-quality artifact, since this is hardware firmware and not an AI/ML library, so real AI exposure is limited to the endpoints on which developers or data scientists run ML workloads. Apply the HP BIOS update from the vendor advisory during normal firmware maintenance, and do not treat this as an emergency.

Sources:NVDEPSSOpenSSFhp.com

What is the risk?

Low overall risk. There is no CVSS score, no known exploitation, no public exploit and no scanner template. The EPSS score (0.00256) is low in absolute terms, even though its percentile is relatively high. Impact is limited to availability of the affected HP workstation or desktop. The listing as an AI tool is likely a mis-association, so the AI-specific risk is indirect: loss of a local development or inference host.

How does the attack unfold?

Initial Access

Attacker gains local or privileged access to an affected HP ProBook 440 G8 or ProDesk 405 G6.

Exploitation

Attacker triggers the BIOS flaw using the method described in the HP advisory.

Impact

The device hangs or fails to boot, interrupting any AI/ML workloads running on it.

AML.T0029

Initial Access

Attacker gains local or privileged access to an affected HP ProBook 440 G8 or ProDesk 405 G6.

Exploitation

Attacker triggers the BIOS flaw using the method described in the HP advisory.

Impact

The device hangs or fails to boot, interrupting any AI/ML workloads running on it.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

5 steps

Review the HP advisory (support.hp.com ish_5818692-5818718-16) and apply the fixed BIOS update to affected ProBook 440 G8 and ProDesk 405 G6 devices.
Inventory endpoints used for ML development and prioritize them for firmware patching.
Restrict physical and administrative access to BIOS settings, and set a BIOS administrator password.
Use endpoint management tooling to report BIOS versions and flag out-of-date firmware.
Check the package-to-product mapping for this CVE in your tracking data, as the pip association appears incorrect.

How is it classified?

DoSFrameworkAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to risks are developed, planned and documented

Frequently Asked Questions

What is CVE-2022-23953?

CVE-2022-23953 is an unscored BIOS vulnerability in some HP ProBook 440 G8 and ProDesk 405 G6 PCs that can cause denial of service. It has no CVSS rating, no CWE, and no attack vector details. The EPSS score is 0.00256, though that sits in the top 84% by percentile. It is not in CISA KEV, has no public exploit, and no Nuclei template. The tracked 'package' mapping (pip, 3,047 dependents) looks like a data-quality artifact, since this is hardware firmware and not an AI/ML library, so real AI exposure is limited to the endpoints on which developers or data scientists run ML workloads. Apply the HP BIOS update from the vendor advisory during normal firmware maintenance, and do not treat this as an emergency.

Is CVE-2022-23953 actively exploited?

No confirmed active exploitation of CVE-2022-23953 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23953?

1. Review the HP advisory (support.hp.com ish_5818692-5818718-16) and apply the fixed BIOS update to affected ProBook 440 G8 and ProDesk 405 G6 devices. 2. Inventory endpoints used for ML development and prioritize them for firmware patching. 3. Restrict physical and administrative access to BIOS settings, and set a BIOS administrator password. 4. Use endpoint management tooling to report BIOS versions and flag out-of-date firmware. 5. Check the package-to-product mapping for this CVE in your tracking data, as the pip association appears incorrect.

What systems are affected by CVE-2022-23953?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Edge inference hosts, Local training environments.

What is the CVSS score for CVE-2022-23953?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Developer workstationsEdge inference hostsLocal training environments

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

Exploitation Scenario

An adversary with local or privileged access to an affected HP workstation abuses the BIOS flaw to crash or hang the device, preventing it from booting or operating normally. If that machine is a data scientist's workstation or a small on-premises inference host, training runs or inference services are interrupted until the device is recovered or reflashed. The exact trigger is not disclosed in the available data, so this scenario is a plausible generalization and not a confirmed exploit path.