Stack Overflow Vulnerability in Aspire E5-475G BIOS Firmware by Acer
CVE-2022-40080

7.8HIGH

Key Information:

Vendor

Acer

Status
Aspire E5-475g Firmware
Vendor
CVE Published:
16 February 2023

What is CVE-2022-40080?

A stack overflow vulnerability has been identified in the BIOS firmware of the Aspire E5-475G, specifically in the FpGui module. This flaw allows local attackers to exploit a second call to the GetVariable services within the UEFI DXE phase, enabling them to execute arbitrary code. If successfully executed, this can lead to escalated privileges, presenting significant security risks for affected installations.

References

https://acer.com/
https://github.com/10TG/vulnerabilities/blob/main/Acer/CV...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.