CVE-2024-23591 json
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an att…
published 2024-02-16 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-21085
- cvss
- 2.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow
an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.
Patch / fix
- Lenovo ThinkSystem SR670 V2 U8E126I-2.20
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 2.3 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
Affected products
- Lenovo ThinkSystem SR670 V2
Classification
- Weakness
-
- CWE-1269 Product Released in Non-Release Configuration
References
-
https
//support.lenovo.com/us/en/product_security/LEN-150020
broken-link, vendor-advisory
- support.lenovo.com /us/en/product_security/LEN-150020
Sources
- CVE List CVE-2024-23591
- NVD CVE-2024-23591
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.