CVE-2022-30426

moderate-risk
Published 2022-09-23

There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (20)

Altos T110 F3 Firmware
Ap130 F2 Firmware
Aspire 1600X Firmware
Aspire 1602M Firmware
Aspire 7600U Firmware
Aspire Mc605 Firmware
Aspire Tc-105 Firmware
Aspire Tc-120 Firmware
Aspire U5-620 Firmware
Aspire X1935 Firmware
Aspire X3475 Firmware
Aspire X3995 Firmware
Aspire Xc100 Firmware
Aspire Xc600 Firmware
Aspire Z3-615 Firmware
Veriton B630 49 Firmware
Veriton E430G Firmware
Veriton E430 Firmware
Veriton M2110G Firmware
Veriton M2120G Firmware

Affected Vendors

Acer

References (6)

Vendor Advisory http://acer.com
Broken Link http://altos.com
Exploit https://github.com/10TG/vulnerabilities/blob/main/Acer/CVE-2022-30426/CVE-2022-3...
Vendor Advisory http://acer.com
Broken Link http://altos.com
Exploit https://github.com/10TG/vulnerabilities/blob/main/Acer/CVE-2022-30426/CVE-2022-3...
47
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 23/34 · High