CVE Feed

    Dashboard / CVE / CVE-2024-45105

    CVE-2024-45105

    An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.

    Published:Sep 13, 2024
    Last Modified:Apr 15, 2026
    EPS:Sep 13, 2024
    EPSS Score:0.0008
    CVSS Score:6.7

    Affected Products

    Vendor
    Lenovo
    Product
    Thinkagile Hx1331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3331 Node Sap Hana
    Vendor
    Lenovo
    Product
    Thinkagile Hx3375 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3376 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5531 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx630 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx630 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx645 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx645 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx650 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx650 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx665 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx665 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx665 V3 Storage Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx665 V3 Storage Integrated Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7530 Appl For Sap Hana
    Vendor
    Lenovo
    Product
    Thinkagile Hx7531 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7531 Node Sap Hana
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-f All-flash Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-h Hybrid Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-f All-flash Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-h Hybrid Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530-h Hybrid Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530 F All Flash Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531-f All-flash Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531 H Hybrid Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx630 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx630 V3 Intergrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx650 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx650 V3 Intergrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx2330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3530-g Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx5530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx630 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx635 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx635 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx645 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx645 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Dpu Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Dpu Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Dpu Sap Hana Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Dpu Sap Hana Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx650 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx655 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx655 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx665 V3 Certified Node Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx665 V3 Integrated System Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7531 Firmware
    Vendor
    Lenovo
    Product
    Thinkedge Se350 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinkedge Se360 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinkedge Se450 Firmware
    Vendor
    Lenovo
    Product
    Thinkedge Se455 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd530 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd550 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd630 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650-n V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd665 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sn550 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr250 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr250 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr258 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr258 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr630 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr630 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr635 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr645 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr645 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr650 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr655 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr665 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr665 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr670 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr675 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr850 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr850 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr860 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr860 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr950 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St250 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St250 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St258 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St258 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St650 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St658 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St658 V3 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-825 Expired Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-8281 (CVSS 7.2) — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with eleva…
    CVE-2024-8280 (CVSS 7.2) — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with eleva…
    CVE-2024-8279 (CVSS 7.2) — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user wi…
    CVE-2024-8278 (CVSS 7.2) — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user wi…
    CVE-2024-2659 (CVSS 7.2) — A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user w…
    CVE-2023-4608 (CVSS 4.1) — An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a …
    CVE-2023-4607 (CVSS 7.5) — An authenticated XCC user can change permissions for any user through a crafted API command.…
    CVE-2023-4606 (CVSS 8.1) — An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted A…
    CVE-2023-0683 (CVSS 8.3) — A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically craf…
    CVE-2023-25492 (CVSS 6.3) — A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High