CVE-2022-4020

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4020
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings Vendor Advisory
https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.2 		v2 : unknown
v3 : 8.1
References () https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - Vendor Advisory () https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - Vendor Advisory

01 Dec 2022, 20:23

Type Values Removed Values Added
CWE CWE-276
References (MISC) https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - (MISC) https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
CPE cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*
cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*
cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*
cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*

28 Nov 2022, 13:55

Type Values Removed Values Added
New CVE
Information

Published : 2022-11-28 13:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-4020

Mitre link : CVE-2022-4020

CVE.ORG link : CVE-2022-4020

JSON object : View

Products Affected

acer

  • extensa_ex215-21_firmware
  • aspire_a115-21
  • aspire_a315-22g_firmware
  • extensa_ex215-21g
  • extensa_ex215-21g_firmware
  • aspire_a115-21_firmware
  • extensa_ex215-21
  • aspire_a315-22
  • aspire_a315-22g
  • aspire_a315-22_firmware
CWE
CWE-276

Incorrect Default Permissions