CVE-2022-4020

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

V

ulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

References

Link	Resource
https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings	Vendor Advisory
https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.2~~	v2 : unknown v3 : 8.1
References	~~() https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - Vendor Advisory~~	() https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings - Vendor Advisory

Information

Published : 2022-11-28 13:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-4020

Mitre link : CVE-2022-4020

CVE.ORG link : CVE-2022-4020

JSON object : View

Products Affected

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2022-4020", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 6.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2022-11-28T13:15:10.180", "references": [{"url": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the\u00a0HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.\n\n\n"}, {"lang": "es", "value": "Una vulnerabilidad en el controlador HQSwSmiDxe DXE en algunos dispositivos port\u00e1tiles Acer de consumo puede permitir que un atacante con privilegios elevados modifique la configuraci\u00f3n de arranque seguro UEFI modificando una variable NVRAM."}], "lastModified": "2024-11-21T07:34:27.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF67F568-6A74-4789-B59A-FFE5D03EF0E6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A638EBAC-1449-4FE2-BBF9-59517E4D4671"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BEBF1F1-34CA-4449-A593-FA0D9C4B3BF2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CE7938F2-00F7-470E-B442-F276D175A4FA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB4C05A5-A52F-4115-B0EB-D445E0EA48AF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1C4616CD-F646-4E62-964E-773A5FDA0507"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28620492-E1FD-4A25-9329-F9987FD75723"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A4B5C395-7349-407C-BD81-9D6D2927F8D5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0557639F-127A-42FE-B5CF-08F3E0A5A296"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E6CD41DC-094E-4765-A234-12CEED5C586C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}