CVE-2022-4020

Acer Aspire BIOS vulnerability

CVSS 8.1 HIGHEPSS 0.2%CWE-276

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.2%KEV nãoPoC —Patch —

Lifecycle

28 Nov 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Affected products

Acer · Aspire A115-21 Acer · Aspire A315-22 Acer · Aspire A315-22G Acer · Extensa EX215-21 Acer · Extensa EX215-21G

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings