CVE-2022-30426 json
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products.
published 2022-09-22 4 y ago modified 2026-07-09 4 mo ago also EUVD-2022-52332
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.
Patch / fix
- acer altos_t110_f3_firmware p13
- acer ap130_f2_firmware p04
- acer aspire_1600x_firmware p11.a3l
- acer aspire_1602m_firmware p11.a3l
- acer aspire_7600u_firmware p11.a4
- acer aspire_mc605_firmware p11.a4l
- acer aspire_tc-105_firmware p12.b0l
- acer aspire_tc-120_firmware p11-a4
- acer aspire_u5-620_firmware p11.a1
- acer aspire_x1935_firmware p11.a3l
- acer aspire_x3475_firmware p11.a3l
- acer aspire_x3995_firmware p11.a3l
- acer aspire_xc100_firmware p11.b3
- acer aspire_xc600_firmware p11.a4
- acer aspire_z3-615_firmware p11.a2l
- acer veriton_b630_49_firmware aap02sr
- acer veriton_e430g_firmware p21.a1
- acer veriton_e430_firmware p11.a4
- acer veriton_m2110g_firmware p21.a3
- acer veriton_m2120g_firmware p11-a3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 17 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/10TG/vulnerabilities/blob/main/Acer/CVE-2022-30426/CVE-2022-30426.md referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/10TG/vulnerabilities/blob/main/Acer/CVE-2022-30426/CVE-2022-30426.md
exploit, third-party-advisory
Sources
- CVE List CVE-2022-30426
- NVD CVE-2022-30426
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.