CVE-2022-4020

—

CVSS 3.1

8.2 high

EPSS

<1%p16

Published

Nov 28, 2022 (Nov 28, 2022)

Modified

Jun 17, 2026

Description

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

Vendors: acer
Products: aspire a315-22g firmware, aspire a115-21 firmware, aspire a315-22 firmware, extensa ex215-21 firmware, extensa ex215-21g firmware
Weakness: CWE-276
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news2 stories

New Flaw in Acer Laptops Could Let Attackers Disable Secure Boot Protection

The Hacker NewsNov 29, 16:39 UTC · Nov 29, 2022Vulnerability CVE-2022-4020

Flaw in some Acer laptops can be used to bypass security features

Security AffairsNov 28, 20:10 UTC · Nov 28, 2022Vulnerability CVE-2022-4020