CVE-2022-4020

Acer Aspire BIOS vulnerability

State: Published
Severity: 8.1 High
Published: Nov 28, 2022
Updated: Apr 14, 2025
Reserved: Nov 16, 2022

Description

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H	ESET

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
Aspire A315-22Acer	1.04 to before 1.11Affected
Aspire A115-21Acer	1.04 to before 1.11Affected
Aspire A315-22GAcer	1.04 to before 1.11Affected
Extensa EX215-21Acer	1.04 to before 1.11Affected
Extensa EX215-21GAcer	1.04 to before 1.11Affected

References

https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.