CVE-2022-4020

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Acer	Aspire A315-22	>= 1.04, < 1.11
Acer	Aspire A115-21	>= 1.04, < 1.11
Acer	Aspire A315-22G	>= 1.04, < 1.11
Acer	Extensa EX215-21	>= 1.04, < 1.11
Acer	Extensa EX215-21G	>= 1.04, < 1.11

References

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-402008.8Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.CVE-2022-402017.8Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed desig CVE-2022-402029.8The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An atta CVE-2022-402038.8Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for Wo CVE-2022-402045.4A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in un CVE-2022-402054.3Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or CVE-2022-402064.3Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or CVE-2022-402077.8Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalatio CVE-2022-402084.3In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz at CVE-2022-402096.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.CVE-2022-40214.3The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This CVE-2022-402107.8Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enab