title: Acer Aspire BIOS vulnerability
description: Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
defaultStatus: unaffected
modules: BIOS/firmware
product: Aspire A315-22
vendor: Acer
versions:
lessThan: 1.11, status: affected, version: 1.04, versionType: custom
}
{
defaultStatus: unaffected
modules: BIOS/firmware
product: Aspire A115-21
vendor: Acer
versions:
lessThan: 1.11, status: affected, version: 1.04, versionType: custom
}
{
defaultStatus: unaffected
modules: BIOS/firmware
product: Aspire A315-22G
vendor: Acer
versions:
lessThan: 1.11, status: affected, version: 1.04, versionType: custom
}
{
defaultStatus: unaffected
modules: BIOS/firmware
product: Extensa EX215-21
vendor: Acer
versions:
lessThan: 1.11, status: affected, version: 1.04, versionType: custom
}
{
defaultStatus: unaffected
modules: BIOS/firmware
product: Extensa EX215-21G
vendor: Acer
versions:
lessThan: 1.11, status: affected, version: 1.04, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL