CVE-2022-4020

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

CVSS v3.0 8.2 HIGH

8.2^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*

Information

Published : 2022-11-28 05:15

Updated : 2022-12-01 12:23

NVD link : CVE-2022-4020

Mitre link : CVE-2022-4020

JSON object : View

CWE

CWE-276

Incorrect Default Permissions

Products Affected

acer

extensa_ex215-21g
aspire_a115-21
aspire_a315-22g
extensa_ex215-21_firmware
aspire_a315-22_firmware
aspire_a315-22
aspire_a315-22g_firmware
aspire_a115-21_firmware
extensa_ex215-21g_firmware
extensa_ex215-21

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings", "name": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-276"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-4020", "ASSIGNER": "security@eset.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}}, "publishedDate": "2022-11-28T13:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-12-01T20:23Z"}

8.2 /10