CVE-2024-23591

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23591
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

2.3 /10

CVSS v3.0 : LOW

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://https://support.lenovo.com/us/en/product_security/LEN-150020 Broken Link Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-150020
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*
History

23 Jul 2025, 15:15

Type Values Removed Values Added
References
  • () https://support.lenovo.com/us/en/product_security/LEN-150020 -

28 Jan 2025, 14:28

Type Values Removed Values Added
First Time Lenovo thinksystem Sr670 V2
Lenovo thinksystem Sr670 V2 Firmware
Lenovo
CWE CWE-1269 NVD-CWE-Other
CVSS v2 : unknown
v3 : 2.0 		v2 : unknown
v3 : 2.3
References () https://https://support.lenovo.com/us/en/product_security/LEN-150020 - () https://https://support.lenovo.com/us/en/product_security/LEN-150020 - Broken Link, Vendor Advisory
CPE cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*

20 Feb 2024, 22:15

Type Values Removed Values Added
Summary ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

16 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-16 17:15

Updated : 2025-07-23 15:15

NVD link : CVE-2024-23591

Mitre link : CVE-2024-23591

JSON object : View

Products Affected

lenovo

  • thinksystem_sr670_v2_firmware
  • thinksystem_sr670_v2
CWE
NVD-CWE-Other