8.2
CVE-2022-4020
- EPSS 0.07%
- Published 28.11.2022 13:15:10
- Last modified 21.11.2024 07:34:27
- Source security@eset.com
- Teams watchlist Login
- Open Login
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
Data is provided by the National Vulnerability Database (NVD)
Acer ≫ Aspire A315-22g Firmware Version-
Acer ≫ Aspire A115-21 Firmware Version-
Acer ≫ Aspire A315-22 Firmware Version-
Acer ≫ Extensa Ex215-21 Firmware Version-
Acer ≫ Extensa Ex215-21g Firmware Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.221 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.2 | 1.5 | 6 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
|
| security@eset.com | 8.1 | 1.5 | 6 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
|
CWE-276 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.