CVE-2024-23591 - CVE House
Back to Database
Status published Low CVE-2024-23591

ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July...

Vulnerability Description

ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23591

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lenovo thanks Eclypsium’s Supply Chain Security Solution for identifying instances of this issue.

References

More from Lenovo

View All →
CVE-2025-9548
A potential null pointer dereference vulnerability was reported in the...
Medium 6.8
CVE-2025-9319
A potential vulnerability was reported in the Lenovo Wallpaper Client...
High 7.5
CVE-2025-9214
A missing authentication vulnerability was reported in some Lenovo printers...
Medium 5.3
CVE-2025-9201
A potential DLL hijacking vulnerability was discovered in Lenovo Browser...
High 8.5
CVE-2025-8557
An internal product security audit of Lenovo XClarity Orchestrator (LXCO)...
High 8.7

Affected Vendor

Affected Software

ThinkSystem SR670 V2
Vulnerable Versions:
0

Timeline

Official Publish: February 16th, 2024
Last Modified: July 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-1269

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.