How severe is CVE-2024-23591?

CVE-2024-23591 has a CVSS 3.x base score of 2.0, rated low severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2024-23591 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-23591?

CVE-2024-23591 affects Lenovo Thinksystem Sr670 V2 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-23591?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-23591 have an EU (EUVD) identifier?

Yes. CVE-2024-23591 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21085.

When was CVE-2024-23591 published?

CVE-2024-23591 was published on 2024-02-16 and last updated on 2026-06-17.

CVE-2024-23591

CVE-2024-23591 is a low-severity vulnerability in Lenovo Thinksystem Sr670 V2 Firmware with a CVSS 3.x base score of 2.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1269.

Key facts

Severity: Low (CVSS 3.x base score 2.0)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-21085
Weakness: CWE-1269
Affected product: Lenovo Thinksystem Sr670 V2 Firmware
Published: 2024-02-16
Last modified: 2026-06-17

Description

ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

Frequently asked questions

What is CVE-2024-23591?: ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.
How severe is CVE-2024-23591?: CVE-2024-23591 has a CVSS 3.x base score of 2.0, rated low severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2024-23591 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-23591?: CVE-2024-23591 affects Lenovo Thinksystem Sr670 V2 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-23591?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-23591 have an EU (EUVD) identifier?: Yes. CVE-2024-23591 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21085.
When was CVE-2024-23591 published?: CVE-2024-23591 was published on 2024-02-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Thinksystem Sr670 V2 Firmware

CVE-2023-0683 — High (CVSS 8.3): A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API…
CVE-2023-4606 — High (CVSS 8.1): An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API…
CVE-2023-4607 — High (CVSS 7.5): An authenticated XCC user can change permissions for any user through a crafted API command.
CVE-2023-29057 — High (CVSS 7.3): A valid XCC user's local account permissions overrides their active directory permissions under specific…
CVE-2022-34884 — High (CVSS 7.2): A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to…
CVE-2023-29058 — Medium (CVSS 6.4): A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the…

All CVEs affecting Lenovo Thinksystem Sr670 V2 Firmware →

Other CWE-1269 vulnerabilities

CVE-2023-5457 — High (CVSS 7.5): A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the…

Browse all CWE-1269 vulnerabilities →