CVE-2022-23958: Jupyter Notebook firmware flaw

CISO Take

CVE-2022-23958 is a BIOS-level vulnerability in certain HP ProBook and ProDesk PCs that can cause denial of service, and it has no direct AI/ML component. Its tie to an AI package is likely a data-mapping artifact (the 'pip' package label and 68 other CVEs on the same package suggest mis-association), so treat the AI-specific risk as low. EPSS is 0.00256 (84th percentile), there is no KEV listing, no public exploit and no Nuclei template, so active exploitation is unlikely. Apply the HP BIOS update from the vendor advisory (ish_5818692-5818718-16) to affected ProBook 440 G8 and ProDesk 405 G6 units as part of normal firmware hygiene, and prioritize it only for endpoints used for local model development or inference where availability matters.

Sources:NVDEPSSOpenSSFhp.com

What is the risk?

Low overall. No CVSS score or CWE is published, but the description limits impact to availability. There is no public exploit, no KEV listing and no scanner template. EPSS of 0.00256 is low in absolute terms, though it ranks in the 84th percentile. Firmware flaws normally need local or privileged access, which further limits exposure. AI risk is indirect: a compromised or crashed workstation interrupts any local ML workload.

How does the attack unfold?

Initial Access

Attacker gains local or privileged access to an affected HP PC.

Exploitation

Attacker triggers the BIOS vulnerability to crash or disable the firmware.

Impact

The workstation becomes unavailable, interrupting any local AI/ML workloads.

Initial Access

Attacker gains local or privileged access to an affected HP PC.

Exploitation

Attacker triggers the BIOS vulnerability to crash or disable the firmware.

Impact

The workstation becomes unavailable, interrupting any local AI/ML workloads.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	—	No patch
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check HP advisory ish_5818692-5818718-16 and install the fixed BIOS version on affected models. 2) Inventory ProBook 440 G8 and ProDesk 405 G6 endpoints and identify any used for ML workloads. 3) Restrict local administrator and physical access, and enable BIOS passwords and Secure Boot. 4) Use endpoint management to enforce firmware update compliance. 5) Verify that the software inventory record linking this CVE to a pip package is correct, and correct it if it is a false association.

How is it classified?

DoSFramework

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and incident recovery

Frequently Asked Questions

What is CVE-2022-23958?

CVE-2022-23958 is a BIOS-level vulnerability in certain HP ProBook and ProDesk PCs that can cause denial of service, and it has no direct AI/ML component. Its tie to an AI package is likely a data-mapping artifact (the 'pip' package label and 68 other CVEs on the same package suggest mis-association), so treat the AI-specific risk as low. EPSS is 0.00256 (84th percentile), there is no KEV listing, no public exploit and no Nuclei template, so active exploitation is unlikely. Apply the HP BIOS update from the vendor advisory (ish_5818692-5818718-16) to affected ProBook 440 G8 and ProDesk 405 G6 units as part of normal firmware hygiene, and prioritize it only for endpoints used for local model development or inference where availability matters.

Is CVE-2022-23958 actively exploited?

No confirmed active exploitation of CVE-2022-23958 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23958?

1) Check HP advisory ish_5818692-5818718-16 and install the fixed BIOS version on affected models. 2) Inventory ProBook 440 G8 and ProDesk 405 G6 endpoints and identify any used for ML workloads. 3) Restrict local administrator and physical access, and enable BIOS passwords and Secure Boot. 4) Use endpoint management to enforce firmware update compliance. 5) Verify that the software inventory record linking this CVE to a pip package is correct, and correct it if it is a false association.

What systems are affected by CVE-2022-23958?

This vulnerability affects the following AI/ML architecture patterns: developer workstations, local model inference, notebook-based experimentation.

What is the CVSS score for CVE-2022-23958?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

developer workstationslocal model inferencenotebook-based experimentation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

Exploitation Scenario

An attacker with local or privileged access to an affected HP workstation triggers the BIOS flaw, for example through crafted firmware interaction, and makes the device fail or become unresponsive. A data scientist's workstation running long local training or inference jobs then loses availability, and the work stops until the device is recovered or reflashed. No model or data compromise results.