CVE-2022-4020 (GCVE-0-2022-4020)
Vulnerability from cvelistv5 – Published: 2022-11-28 13:00 – Updated: 2025-04-14 18:16
VLAI?
Summary
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
Severity ?
8.1 (High)
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Acer | Aspire A315-22 |
Affected:
1.04 , < 1.11
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Martin Smolár @ ESET
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:27:54.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T18:15:55.381686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T18:16:59.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"BIOS/firmware"
],
"product": "Aspire A315-22",
"vendor": "Acer",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "1.04",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"BIOS/firmware"
],
"product": "Aspire A115-21",
"vendor": "Acer",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "1.04",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"BIOS/firmware"
],
"product": "Aspire A315-22G",
"vendor": "Acer",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "1.04",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"BIOS/firmware"
],
"product": "Extensa EX215-21",
"vendor": "Acer",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "1.04",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"BIOS/firmware"
],
"product": "Extensa EX215-21G",
"vendor": "Acer",
"versions": [
{
"lessThan": "1.11",
"status": "affected",
"version": "1.04",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Martin Smol\u00e1r @ ESET "
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVulnerability in the\u0026nbsp;HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Vulnerability in the\u00a0HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-176",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-176 Configuration/Environment Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-28T13:00:01.057Z",
"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"shortName": "ESET"
},
"references": [
{
"url": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Acer Aspire BIOS vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
"assignerShortName": "ESET",
"cveId": "CVE-2022-4020",
"datePublished": "2022-11-28T13:00:01.057Z",
"dateReserved": "2022-11-16T12:09:56.043Z",
"dateUpdated": "2025-04-14T18:16:59.908Z",
"requesterUserId": "ab43066b-9998-4678-8410-2f6be6ec6907",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF67F568-6A74-4789-B59A-FFE5D03EF0E6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A638EBAC-1449-4FE2-BBF9-59517E4D4671\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2BEBF1F1-34CA-4449-A593-FA0D9C4B3BF2\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE7938F2-00F7-470E-B442-F276D175A4FA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB4C05A5-A52F-4115-B0EB-D445E0EA48AF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C4616CD-F646-4E62-964E-773A5FDA0507\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28620492-E1FD-4A25-9329-F9987FD75723\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4B5C395-7349-407C-BD81-9D6D2927F8D5\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0557639F-127A-42FE-B5CF-08F3E0A5A296\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6CD41DC-094E-4765-A234-12CEED5C586C\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Vulnerability in the\\u00a0HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en el controlador HQSwSmiDxe DXE en algunos dispositivos port\\u00e1tiles Acer de consumo puede permitir que un atacante con privilegios elevados modifique la configuraci\\u00f3n de arranque seguro UEFI modificando una variable NVRAM.\"}]",
"id": "CVE-2022-4020",
"lastModified": "2024-11-21T07:34:27.610",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@eset.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 6.0}]}",
"published": "2022-11-28T13:15:10.180",
"references": "[{\"url\": \"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\", \"source\": \"security@eset.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "security@eset.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@eset.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-4020\",\"sourceIdentifier\":\"security@eset.com\",\"published\":\"2022-11-28T13:15:10.180\",\"lastModified\":\"2024-11-21T07:34:27.610\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in the\u00a0HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\\n\\n\\n\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en el controlador HQSwSmiDxe DXE en algunos dispositivos port\u00e1tiles Acer de consumo puede permitir que un atacante con privilegios elevados modifique la configuraci\u00f3n de arranque seguro UEFI modificando una variable NVRAM.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@eset.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security@eset.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF67F568-6A74-4789-B59A-FFE5D03EF0E6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A638EBAC-1449-4FE2-BBF9-59517E4D4671\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BEBF1F1-34CA-4449-A593-FA0D9C4B3BF2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE7938F2-00F7-470E-B442-F276D175A4FA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB4C05A5-A52F-4115-B0EB-D445E0EA48AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C4616CD-F646-4E62-964E-773A5FDA0507\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28620492-E1FD-4A25-9329-F9987FD75723\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4B5C395-7349-407C-BD81-9D6D2927F8D5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0557639F-127A-42FE-B5CF-08F3E0A5A296\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6CD41DC-094E-4765-A234-12CEED5C586C\"}]}]}],\"references\":[{\"url\":\"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\",\"source\":\"security@eset.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:27:54.370Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-4020\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-14T18:15:55.381686Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-14T18:16:06.510Z\"}}], \"cna\": {\"title\": \"Acer Aspire BIOS vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Martin Smol\\u00e1r @ ESET \"}], \"impacts\": [{\"capecId\": \"CAPEC-176\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-176 Configuration/Environment Manipulation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Acer\", \"modules\": [\"BIOS/firmware\"], \"product\": \"Aspire A315-22\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04\", \"lessThan\": \"1.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Acer\", \"modules\": [\"BIOS/firmware\"], \"product\": \"Aspire A115-21\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04\", \"lessThan\": \"1.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Acer\", \"modules\": [\"BIOS/firmware\"], \"product\": \"Aspire A315-22G\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04\", \"lessThan\": \"1.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Acer\", \"modules\": [\"BIOS/firmware\"], \"product\": \"Extensa EX215-21\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04\", \"lessThan\": \"1.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Acer\", \"modules\": [\"BIOS/firmware\"], \"product\": \"Extensa EX215-21G\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04\", \"lessThan\": \"1.11\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vulnerability in the\\u00a0HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eVulnerability in the\u0026nbsp;HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\u003c/span\u003e\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276 Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"4a9b9929-2450-4021-b7b9-469a0255b215\", \"shortName\": \"ESET\", \"dateUpdated\": \"2022-11-28T13:00:01.057Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-4020\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-14T18:16:59.908Z\", \"dateReserved\": \"2022-11-16T12:09:56.043Z\", \"assignerOrgId\": \"4a9b9929-2450-4021-b7b9-469a0255b215\", \"datePublished\": \"2022-11-28T13:00:01.057Z\", \"requesterUserId\": \"ab43066b-9998-4678-8410-2f6be6ec6907\", \"assignerShortName\": \"ESET\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…