← Back

CVE-2024-23591

nvd nist
Published: Feb 16, 2024Modified: Jun 17, 2026

JSON object

Loading...
2.3
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Exploitability: 0.8 / Impact: 1.4
Source: NVD

Description

ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

Affected (1)

Lenovo
1 product
Thinksystem Sr670 V2 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Thinksystem Sr670 V2 Firmware
Before u8e126i-2.20
Running on/withPlatform Versions
Lenovo
Thinksystem Sr670 V2
All versions

Related CWEs

CWE-1269
Product Released in Non-Release Configuration
The product released to market is released in pre-production or manufacturing configuration.

References (2)

Source: psirt@lenovo.com
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkVendor Advisory

Timeline

No history available yet.