Vulnerability in Acer Altos R680 F4

CVE-2024-8105

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

EPSS: 0.003 (19.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Acer Altos R680 F4 — versions a2679a9595a104d70bddc024dbc4f65f0dc9d906f30a0d1ae6b996b14246a6c2
  • Acer Altos R680s F4 — versions e5fdaabf11b236c5c7b040d674936e84db746a180ab9999317e16dcb77aeeba4
  • Acer Aspire C22-1600 — versions d938d08543d35d4249a51057c1d9c62bb1f6440af19913c5feffcea47dd3de95
  • Acer Aspire S 27 — versions 2bd2bfaf79a72eaca45e544e5c6a5bb842b292bdc229b8975b3101a4013e0d5f
  • Acer Aspire S32-1856 — versions 29837e239487cc83818a7f40f9280d9692a50376487899edd603494b0f30e4c5
  • Acer Aspire Xc-1710 — versions cdaa406bda1a58fbe9933622dec218a26f79871d42f0d3576fbf878e51a16201
  • Acer C24-1655 — versions 399f68dc94a6c42030efcd57fd034ff721f860b7b5d447779e7a6a6c99aba34f
  • Acer C24-962 — versions 3d525f96f63995c51ab1bcd2c50ebb71661ffeca9f78f97cc97e851d0e2bbbdd
  • Acer Vz2694g — versions d61d0e09d008bfb29bc32532b1b94fcc4ee2af5e8372c6d38722a4e73ecc71d6
  • Aopen Iaplx-de(taa30 Test) — versions 94c6f84946db100b505af8a308f69ef6cddc2e310b50641a6e2e63bc9aed54e0

References

Frequently asked questions

What is CVE-2024-8105?
CVE-2024-8105 is a medium-severity vulnerability in Acer Altos R680 F4, classified under CWE-321: USE OF HARD-CODED CRYPTOGRAPHIC KEY. CVSS score: 6.4/10. Published 2024-08-26.
How severe is CVE-2024-8105?
Medium severity. CVSS v3 base score is 6.4 out of 10.