CVE-2022-4020 Acer Aspire BIOS vulnerability
An attacker with elevated privileges can modify UEFI Secure Boot settings by altering NVRAM variables in specific Acer notebook BIOS drivers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4020?
CVE-2022-4020 is a high-severity vulnerability in Acer Aspire A115-21, published on 28 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
Weakness: CWE-276
Which versions are affected by CVE-2022-4020?
It affects 5 products.
Products include Acer Aspire A115-21 Firmware, Acer Aspire A315-22 Firmware, Acer Aspire A315-22g Firmware, Acer Extensa Ex215-21 Firmware, Acer Extensa Ex215-21g Firmware.
How do I fix CVE-2022-4020?
No fix has been published for CVE-2022-4020 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4020 being exploited?
There is no known exploitation of CVE-2022-4020 in the wild and no public exploit code.
Sources
Also known as GHSA-42r4-ffjv-m633.