CVE-2022-23954: Jupyter Notebook firmware flaw

CISO Take

This CVE describes a denial-of-service weakness in the BIOS of certain HP PCs (ProBook 440 G8, ProDesk 405 G6). It is a hardware firmware issue, not an AI/ML software flaw. The 'pip' package tag and 'ai_tool' category appear to be a mis-association in the data, so treat this record as likely a false positive for AI threat tracking. Exploitation likelihood is low-to-moderate (EPSS 0.00256, though that sits in the 84th percentile), there is no public exploit, no Nuclei template, and it is not in CISA KEV. The 3,047 downstream dependents and 68 other CVEs on the linked package reflect the mis-mapped package, not exposure from this BIOS issue. If these HP models are in your fleet, apply the BIOS update from the HP advisory (ish_5818692-5818718-16) through your normal firmware patch cycle. No emergency action is needed for AI workloads.

Sources:NVDEPSSHP vendor advisory (support.hp.com)ATLAS

What is the risk?

Low for AI/ML systems. The vulnerability is a BIOS-level denial of service with no CVSS score, no CWE, no known exploit and no KEV listing. Exploitation would typically need local or privileged access to the endpoint firmware. The main risk is availability loss on affected HP workstations, which matters only if they host AI development or inference work. Confidence that this CVE is relevant to AI/ML is LOW because the package mapping looks incorrect.

How does the attack unfold?

Initial Access

Attacker gains local or privileged access to an unpatched HP PC with the vulnerable BIOS.

Exploitation

Attacker triggers the BIOS flaw to put the firmware into a fault state.

Impact

The device hangs or fails to boot, causing denial of service for any AI workloads on the host.

AML.T0029

Initial Access

Attacker gains local or privileged access to an unpatched HP PC with the vulnerable BIOS.

Exploitation

Attacker triggers the BIOS flaw to put the firmware into a fault state.

Impact

The device hangs or fails to boot, causing denial of service for any AI workloads on the host.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check the HP advisory (support.hp.com document ish_5818692-5818718-16) for the fixed BIOS (SoftPaq) version. 2) Inventory ProBook 440 G8 and ProDesk 405 G6 devices, especially those used for ML development. 3) Deploy the BIOS update through your endpoint management tooling and protect BIOS access with a setup password. 4) Enable Secure Boot and firmware integrity monitoring. 5) Review the package mapping in the threat-intelligence data so the record is not tied to an unrelated pip package.

How is it classified?

DoSFrameworkAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks are developed and applied

Frequently Asked Questions

What is CVE-2022-23954?

This CVE describes a denial-of-service weakness in the BIOS of certain HP PCs (ProBook 440 G8, ProDesk 405 G6). It is a hardware firmware issue, not an AI/ML software flaw. The 'pip' package tag and 'ai_tool' category appear to be a mis-association in the data, so treat this record as likely a false positive for AI threat tracking. Exploitation likelihood is low-to-moderate (EPSS 0.00256, though that sits in the 84th percentile), there is no public exploit, no Nuclei template, and it is not in CISA KEV. The 3,047 downstream dependents and 68 other CVEs on the linked package reflect the mis-mapped package, not exposure from this BIOS issue. If these HP models are in your fleet, apply the BIOS update from the HP advisory (ish_5818692-5818718-16) through your normal firmware patch cycle. No emergency action is needed for AI workloads.

Is CVE-2022-23954 actively exploited?

No confirmed active exploitation of CVE-2022-23954 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23954?

1) Check the HP advisory (support.hp.com document ish_5818692-5818718-16) for the fixed BIOS (SoftPaq) version. 2) Inventory ProBook 440 G8 and ProDesk 405 G6 devices, especially those used for ML development. 3) Deploy the BIOS update through your endpoint management tooling and protect BIOS access with a setup password. 4) Enable Secure Boot and firmware integrity monitoring. 5) Review the package mapping in the threat-intelligence data so the record is not tied to an unrelated pip package.

What systems are affected by CVE-2022-23954?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, on-premises inference hosts.

What is the CVSS score for CVE-2022-23954?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

developer workstationson-premises inference hosts

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

Exploitation Scenario

An attacker with local or administrative access to an unpatched HP workstation triggers the BIOS flaw, for example through a crafted firmware interaction, causing the system to hang or fail to boot. If the machine is an ML developer workstation or a small on-premises inference box, this interrupts training jobs or local model serving until the device is recovered. The attack gives no access to models or data.