8.2

CVE-2022-4020

Acer Aspire BIOS vulnerability

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Acer ≫ Aspire A315-22g Firmware Version -
   Acer ≫ Aspire A315-22g Version -
Acer ≫ Aspire A115-21 Firmware Version -
   Acer ≫ Aspire A115-21 Version -
Acer ≫ Aspire A315-22 Firmware Version -
   Acer ≫ Aspire A315-22 Version -
Acer ≫ Extensa Ex215-21 Firmware Version -
   Acer ≫ Extensa Ex215-21 Version -
Acer ≫ Extensa Ex215-21g Firmware Version -
   Acer ≫ Extensa Ex215-21g Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.147
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.2 1.5 6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
security@eset.com 8.1 1.5 6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings
Vendor Advisory