CVE-2024-23591

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23591
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

2.0 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.6 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://https://support.lenovo.com/us/en/product_security/LEN-150020 Broken Link Vendor Advisory
https://https://support.lenovo.com/us/en/product_security/LEN-150020 Broken Link Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*
History

28 Jan 2025, 14:28

Type Values Removed Values Added
First Time Lenovo
Lenovo thinksystem Sr670 V2
Lenovo thinksystem Sr670 V2 Firmware
CWE NVD-CWE-Other
CPE cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*
References () https://https://support.lenovo.com/us/en/product_security/LEN-150020 - () https://https://support.lenovo.com/us/en/product_security/LEN-150020 - Broken Link, Vendor Advisory

21 Nov 2024, 08:57

Type Values Removed Values Added
References () https://https://support.lenovo.com/us/en/product_security/LEN-150020 - () https://https://support.lenovo.com/us/en/product_security/LEN-150020 -

20 Feb 2024, 22:15

Type Values Removed Values Added
Summary
  • (es) Los servidores ThinkSystem SR670V2 fabricados aproximadamente entre junio de 2021 y julio de 2023 se dejaron en modo de fabricación, lo que podría permitir a un atacante con acceso lógico privilegiado al host o acceso físico a las partes internas del servidor modificar o deshabilitar la Integridad del firmware Intel Boot Guard, seguridad de SPS y otros ajustes de configuración de SPS.
Summary (en) ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. (en) ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

16 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-16 17:15

Updated : 2025-01-28 14:28

NVD link : CVE-2024-23591

Mitre link : CVE-2024-23591

CVE.ORG link : CVE-2024-23591

JSON object : View

Products Affected

lenovo

  • thinksystem_sr670_v2_firmware
  • thinksystem_sr670_v2
CWE
CWE-1269

Product Released in Non-Release Configuration

NVD-CWE-Other