CVE-2022-23956: Jupyter Notebook firmware flaw

CISO Take

This is a denial-of-service vulnerability in the BIOS of certain HP PCs (ProBook 440 G8, ProDesk 405 G6), disclosed in March 2022 with no CVSS score, CWE or attack vector published. It is not an AI/ML vulnerability: the 'pip' package and 'ai_tool' tagging look like a catalog mis-association, so the 3,047 downstream dependents and 68 other CVEs attributed to the package should not drive urgency. Exploitation likelihood is low to moderate (EPSS 0.00256, top 84% percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Apply HP's BIOS update from the vendor advisory (ish_5818692-5818718-16) on affected endpoints through normal patch cycles, and review the package mapping in your asset inventory rather than treating this as an AI supply-chain event.

Sources:NVDEPSSOpenSSFsupport.hp.com

What is the risk?

Low risk for AI/ML environments. The flaw affects firmware on specific HP workstation and laptop models and, per the description, results in availability loss only. No CVSS vector, attack complexity or privilege data is published, so exploitability cannot be confirmed. EPSS is 0.00256 with no known exploit, no KEV listing and no scanner template. Confidence is LOW because the record is sparse and the AI package association appears erroneous.

How does the attack unfold?

Initial Access

Attacker gains the local or privileged access needed to reach the vulnerable BIOS functionality on an affected HP PC.

Exploitation

The attacker triggers the BIOS flaw, causing a crash or boot failure.

Impact

The endpoint becomes unavailable, interrupting any local AI/ML development or workloads running on it.

Initial Access

Attacker gains the local or privileged access needed to reach the vulnerable BIOS functionality on an affected HP PC.

Exploitation

The attacker triggers the BIOS flaw, causing a crash or boot failure.

Impact

The endpoint becomes unavailable, interrupting any local AI/ML development or workloads running on it.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Review the HP advisory (support.hp.com ish_5818692-5818718-16) and identify affected models in your asset inventory. 2) Deploy the fixed BIOS version through HP Support Assistant, HP Image Assistant or your endpoint management tooling. 3) Restrict physical and administrative access to BIOS settings and set a BIOS admin password. 4) Enable firmware integrity monitoring and keep Secure Boot enabled. 5) Verify and correct the pip package mapping in your SBOM or vulnerability scanner to avoid false positives.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFramework

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2022-23956?

This is a denial-of-service vulnerability in the BIOS of certain HP PCs (ProBook 440 G8, ProDesk 405 G6), disclosed in March 2022 with no CVSS score, CWE or attack vector published. It is not an AI/ML vulnerability: the 'pip' package and 'ai_tool' tagging look like a catalog mis-association, so the 3,047 downstream dependents and 68 other CVEs attributed to the package should not drive urgency. Exploitation likelihood is low to moderate (EPSS 0.00256, top 84% percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Apply HP's BIOS update from the vendor advisory (ish_5818692-5818718-16) on affected endpoints through normal patch cycles, and review the package mapping in your asset inventory rather than treating this as an AI supply-chain event.

Is CVE-2022-23956 actively exploited?

No confirmed active exploitation of CVE-2022-23956 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23956?

1) Review the HP advisory (support.hp.com ish_5818692-5818718-16) and identify affected models in your asset inventory. 2) Deploy the fixed BIOS version through HP Support Assistant, HP Image Assistant or your endpoint management tooling. 3) Restrict physical and administrative access to BIOS settings and set a BIOS admin password. 4) Enable firmware integrity monitoring and keep Secure Boot enabled. 5) Verify and correct the pip package mapping in your SBOM or vulnerability scanner to avoid false positives.

What systems are affected by CVE-2022-23956?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, local training pipelines.

What is the CVSS score for CVE-2022-23956?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

developer workstationslocal training pipelines

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

Exploitation Scenario

Per the description, an attacker with the ability to trigger the vulnerable BIOS code path, likely local or privileged access, could cause the system to crash or fail to boot, interrupting an AI developer workstation running a local training or inference job. No further details have been published, and no AI-specific attack path exists.