CVE-2022-23955: Jupyter Notebook firmware flaw

CISO Take

This is a BIOS-level denial-of-service flaw in certain HP ProBook 440 G8 and ProDesk 405 G6 PCs, and it is not an AI/ML software vulnerability. The pip package mapping looks like a data-matching artifact: nothing in the CVE data ties it to a Python AI library, and no CWE, CVSS score or affected version range is published. Risk signals are low to moderate: EPSS is 0.00256 (top 84th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Treat it as routine endpoint hygiene. Apply the HP BIOS update from the vendor advisory (ish_5818692-5818718-16) on affected workstations, with priority for machines used as AI/ML developer or inference hosts. No breaking alert is warranted.

Sources:NVDEPSSOpenSSFhp.com

What is the risk?

Low. There is no CVSS score, no known exploitation, no public exploit and no scanner template. The EPSS percentile (84th) is relatively high but the absolute probability is very low (0.26%). Impact is limited to availability of the affected HP endpoint. Exposure depends on how much AI/ML work runs on these specific laptop and desktop models. The package-level context (3,047 dependents, 68 other CVEs) most likely belongs to an unrelated package mapping and should not raise the rating for this CVE.

How does the attack unfold?

Initial Access

Attacker gains local or privileged access to an affected HP ProBook or ProDesk device.

Exploitation

Attacker triggers the BIOS flaw using conditions not disclosed in the advisory.

Impact

The device suffers denial of service, interrupting any local AI/ML development or inference work hosted on it.

AML.T0029

Initial Access

Attacker gains local or privileged access to an affected HP ProBook or ProDesk device.

Exploitation

Attacker triggers the BIOS flaw using conditions not disclosed in the advisory.

Impact

The device suffers denial of service, interrupting any local AI/ML development or inference work hosted on it.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check the HP advisory (support.hp.com document ish_5818692-5818718-16) and install the fixed BIOS version on the listed models. 2) Inventory affected HP models, especially those used for AI/ML development or local inference. 3) Restrict physical and administrative access to firmware settings, and enforce a BIOS administrator password. 4) Monitor for unexpected device hangs or failed boots on these models. 5) Review the package mapping in the asset inventory, since the pip association appears spurious.

How is it classified?

DoSFramework

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from identified risks

Frequently Asked Questions

What is CVE-2022-23955?

This is a BIOS-level denial-of-service flaw in certain HP ProBook 440 G8 and ProDesk 405 G6 PCs, and it is not an AI/ML software vulnerability. The pip package mapping looks like a data-matching artifact: nothing in the CVE data ties it to a Python AI library, and no CWE, CVSS score or affected version range is published. Risk signals are low to moderate: EPSS is 0.00256 (top 84th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Treat it as routine endpoint hygiene. Apply the HP BIOS update from the vendor advisory (ish_5818692-5818718-16) on affected workstations, with priority for machines used as AI/ML developer or inference hosts. No breaking alert is warranted.

Is CVE-2022-23955 actively exploited?

No confirmed active exploitation of CVE-2022-23955 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23955?

1) Check the HP advisory (support.hp.com document ish_5818692-5818718-16) and install the fixed BIOS version on the listed models. 2) Inventory affected HP models, especially those used for AI/ML development or local inference. 3) Restrict physical and administrative access to firmware settings, and enforce a BIOS administrator password. 4) Monitor for unexpected device hangs or failed boots on these models. 5) Review the package mapping in the asset inventory, since the pip association appears spurious.

What systems are affected by CVE-2022-23955?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, local inference hosts.

What is the CVSS score for CVE-2022-23955?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

developer workstationslocal inference hosts

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

Exploitation Scenario

An attacker with local or administrative access to an affected HP workstation triggers the BIOS flaw to make the device unusable or fail to boot. If the device hosted a local AI development environment or a small inference workload, that work would be interrupted until the firmware is recovered. The exact trigger conditions are not disclosed in the advisory data available.