Acer Aspire BIOS vulnerability
Priority LOW 35CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed Aspire A315-22 (Acer): 1.11Aspire A115-21 (Acer): 1.11+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Acer | Aspire A315-22 | 1.04 to before 1.11 | 1.11 | Patch available | CNA |
| Acer | Aspire A115-21 | 1.04 to before 1.11 | 1.11 | Patch available | CNA |
| Acer | Aspire A315-22G | 1.04 to before 1.11 | 1.11 | Patch available | CNA |
| Acer | Extensa EX215-21 | 1.04 to before 1.11 | 1.11 | Patch available | CNA |
| Acer | Extensa EX215-21G | 1.04 to before 1.11 | 1.11 | Patch available | CNA |
- Aspire A315-22 VendorAcer Affected 1.04 to before 1.11 Fixed in 1.11 Patch available CNA
- Aspire A115-21 VendorAcer Affected 1.04 to before 1.11 Fixed in 1.11 Patch available CNA
- Aspire A315-22G VendorAcer Affected 1.04 to before 1.11 Fixed in 1.11 Patch available CNA
- Extensa EX215-21 VendorAcer Affected 1.04 to before 1.11 Fixed in 1.11 Patch available CNA
- Extensa EX215-21G VendorAcer Affected 1.04 to before 1.11 Fixed in 1.11 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acer |
| cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acer |
| cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
- cpe:2.3:o:acer:aspire_a315-22g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_a315-22g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_a115-21_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_a115-21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_a315-22_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_a315-22:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:extensa_ex215-21_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acer
- cpe:2.3:h:acer:extensa_ex215-21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:extensa_ex215-21g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acer
- cpe:2.3:h:acer:extensa_ex215-21g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
Remediation
- Fix · CNA Aspire A315-22 (Acer) Fixed in 1.11
- Fix · CNA Aspire A115-21 (Acer) Fixed in 1.11
- Fix · CNA Aspire A315-22G (Acer) Fixed in 1.11
- Fix · CNA Extensa EX215-21 (Acer) Fixed in 1.11
- Fix · CNA Extensa EX215-21G (Acer) Fixed in 1.11
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4020
- 2026-10-03 Alias added: GHSA-42r4-ffjv-m633
References
Sources
- CVE-2022-4020 · CVE Program
- CVE-2022-4020 · NVD
- FIRST EPSS
- GHSA-42r4-ffjv-m633 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences