CVE-2022-4020

Acer Aspire BIOS vulnerability

High8.1EPSS 0.25%

Published: 28 Nov 2022
Updated: 14 Apr 2025
Reserved: 16 Nov 2022
Assigned by: ESET

Description

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

Scores

CVSS scores of CVE-2022-4020, by who scored it
Scored by	CVSS	Score	Vector
ESETCNA (assigner)	3.1	High8.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
NVDNVD · Modified	3.1	High8.2	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.25% · top 84% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

CWE-276 Incorrect Default Permissions (opens in a new tab)All about CWE-276 and its CVEs

Affected products

Acer · Aspire A315-22
- affected 1.04 – < 1.11
Acer · Aspire A115-21
- affected 1.04 – < 1.11
Acer · Aspire A315-22G
- affected 1.04 – < 1.11
Acer · Extensa EX215-21
- affected 1.04 – < 1.11
Acer · Extensa EX215-21G
- affected 1.04 – < 1.11

References (1)

https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-4020](https://trackcve.app/badge/CVE-2022-4020.svg)](https://trackcve.app/cve/CVE-2022-4020)

Record last updated 14 Apr 2025, 18:16 UTC.