CVE Feed

    Dashboard / CVE / CVE-2024-23591

    CVE-2024-23591

    ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.

    Published:Feb 16, 2024
    Last Modified:Jul 23, 2025
    EPS:Feb 16, 2024
    EPSS Score:0.00036
    CVSS Score:2

    Affected Products

    Vendor
    Lenovo
    Product
    Thinksystem Sr670 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr670 V2 Firmware

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-439 Manipulation During Distribution

    Related CVEs

    CVE-2023-4608 (CVSS 4.1) — An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a …
    CVE-2023-4607 (CVSS 7.5) — An authenticated XCC user can change permissions for any user through a crafted API command.…
    CVE-2023-4606 (CVSS 8.1) — An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted A…
    CVE-2023-0683 (CVSS 8.3) — A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically craf…
    CVE-2023-25492 (CVSS 6.3) — A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other …
    CVE-2023-25495 (CVSS 4.9) — A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client …
    CVE-2023-29056 (CVSS 5.3) — A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into X…
    CVE-2023-29057 (CVSS 7.3) — A valid XCC user's local account permissions overrides their active directory permissions under specific confi…
    CVE-2023-29058 (CVSS 6.4) — A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts…
    CVE-2022-34888 (CVSS 2.7) — The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to intern…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High