CVE-2024-23591
Low
Description
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.
SeverityLow
CVSS2.0
Exploit probability—
ProductLenovo Thinksystem Sr670 V2 Firmware
PublishedFeb 16, 2024
First seenFeb 16, 2024
Weakness typeCWE-1269CWE-1269
How to fix
Update
- lenovo thinksystem_sr670_v2_firmwareu8e126i-2.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinksystem_sr670_v2_firmware | v < u8e126i-2.20 | u8e126i-2.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.