Vulnerability - HP Envy 750 - Intel CSME tool reports "This system is vulnerable”.

[KW115]

HP closed my previous post from Q4 2020. Here is a current update:

HP Envy 750 - Intel CSME tool reports "This system is vulnerable”.

Update Feb 2021:

Applied all available SP, BIOS and Firmware.

Rebooted system. Run most current version of CSME tool. 

It reports as follows: 

Tool Started 02/16/21 1:12:17 PM
Name: KEVINS-DESKTOP
Manufacturer: HP
Model: 750-177c
Processor Name: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz
OS Version: Microsoft Windows 10 Home
Status: This system is vulnerable.
Tool Stopped

HP so far has been unable or unwilling to provide any meaningful help.

[Grzwacz]

Hi,

You updated to the latest BIOS and firmware. So you installed this latest ME update (Link). You would need the latest BIOS update in addition to the ME update to see if your system has been patched.

You have a H110 chipset. You can't know if Intel or HP is at fault unless you verify Intel has released a fix for your platform. Intel was patching newer hardware first. Your hardware is over five years old.

I ran the latest CSME 4.1.0.0 on a Z390 MB. The system passed.

Regards

[KW115]

I do not have access to the desktop in question at the moment. However, I don't recall ever getting a notice from HP that my machine was excluded from further support due to the date it was purchased. HP ALWAYS told during all of my attempts for help in 2020 to mitigate or resolve their Security Vulnerability that they would support my desktop, but ONLY at a price!

[Grzwacz]

Hi,

Older Intel CPUs have vulnerabilities which Intel can mitigate to a certain point but cannot completely fix. I don't know if your PC falls into this category. You would have to identify the specific problem. Then check to see if Intel updated the microcode to fix the problem.

Now you have to see if the latest HP BIOS update includes the microcode developed by Intel to fix the problem. HP is not going to charge for this BIOS update. I have a i7-6700k which has never been fixed, it is vulnerable and will probably never be secured because the hardware problem is not completely fixable.

Either live with this or replace the hardware.

Regards

[KW115]

I would much prefer to hear facts from HP directly. While I appreciate you responding to my post, your response is not that of HP and is your opinion at best. 

[Grzwacz]

Hi,

You're very welcome.

Contact HP again. You will not get a official HP response in this forum.

Regards

[KW115]

I have tried numerous times in the past 8 weeks. I have tried private messages that I used last year that were recommended to me by HP employees / TS. The 2 individuals will no longer respond to any of my private messages. 

HP refuses to continue a dialogue with me. 

HP would be happy however to take my money on  a best effort basis, no promises, just a bill for "effort". I have the email that states that almost to the word. Now that sounds like a deal, for a hardware platform design and manufacture that is 100% HP's doing.