CVE-2024-23591

ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

CVSS v3 2.0 LOW

2.0^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.6 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://https://support.lenovo.com/us/en/product_security/LEN-150020	Broken Link Vendor Advisory
https://https://support.lenovo.com/us/en/product_security/LEN-150020	Broken Link Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*

History

28 Jan 2025, 14:28

Type	Values Removed	Values Added
First Time		Lenovo thinksystem Sr670 V2 Firmware Lenovo thinksystem Sr670 V2 Lenovo
CWE		NVD-CWE-Other
CPE		cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:::::::* cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware::::::::
References	~~() https://https://support.lenovo.com/us/en/product_security/LEN-150020 -~~	() https://https://support.lenovo.com/us/en/product_security/LEN-150020 - Broken Link, Vendor Advisory

Information

Published : 2024-02-16 17:15

Updated : 2025-01-28 14:28

NVD link : CVE-2024-23591

Mitre link : CVE-2024-23591

CVE.ORG link : CVE-2024-23591

JSON object : View

Products Affected

lenovo

thinksystem_sr670_v2
thinksystem_sr670_v2_firmware

CWE

CWE-1269

Product Released in Non-Release Configuration

NVD-CWE-Other

{"id": "CVE-2024-23591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.0, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.8}]}, "published": "2024-02-16T17:15:08.800", "references": [{"url": "https://https://support.lenovo.com/us/en/product_security/LEN-150020", "tags": ["Broken Link", "Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "https://https://support.lenovo.com/us/en/product_security/LEN-150020", "tags": ["Broken Link", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@lenovo.com", "description": [{"lang": "en", "value": "CWE-1269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow \n\nan attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting.\u00a0The server\u2019s NIST SP\n800-193-compliant Platform Firmware Resiliency (PFR) security subsystem\nsignificantly mitigates this issue."}, {"lang": "es", "value": "Los servidores ThinkSystem SR670V2 fabricados aproximadamente entre junio de 2021 y julio de 2023 se dejaron en modo de fabricaci\u00f3n, lo que podr\u00eda permitir a un atacante con acceso l\u00f3gico privilegiado al host o acceso f\u00edsico a las partes internas del servidor modificar o deshabilitar la Integridad del firmware Intel Boot Guard, seguridad de SPS y otros ajustes de configuraci\u00f3n de SPS."}], "lastModified": "2025-01-28T14:28:25.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AA53CBF-969A-44F9-9514-6198FEB20636", "versionEndExcluding": "u8e126i-2.20"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E97E5B4D-0E6F-49B0-8466-54A818517965"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@lenovo.com"}