What’s Vulnerable › Vulnerabilities

CVE-2022-4020: Acer Aspire BIOS vulnerability

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-28 · updated 2026-06-17
• Weakness: CWE-276

Description

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.

Affected products

• Acer Aspire A115-21 Firmware: all versions
• Acer Aspire A315-22 Firmware: all versions
• Acer Aspire A315-22G Firmware: all versions
• Acer Extensa Ex215-21 Firmware: all versions
• Acer Extensa Ex215-21G Firmware: all versions

References

• https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings
• https://community.acer.com/en/kb/articles/15520-security-vulnerability-regarding-vulnerability-that-may-allow-changes-to-secure-boot-settings

Get alerted when CVE-2022-4020 or the next vulnerability affects your stack