Thinksystem Sr670 V2 Firmware

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

VendorLenovo (c98ed681-bc65-5c44-8bbb-e0a228f96d0e)
ProductThinksystem Sr670 V2 Firmware (8652503f-6248-5374-b9de-8b7057e82b59)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-23591 vulnerable 2026-06-08 06:29:39.976034 Details available
LOW (2)
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.
Published: 2024-02-16T16:17:58.614Z
Updated: 2025-07-23T14:23:24.383Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29058 vulnerable 2026-06-08 06:02:38.431320 Details available
MEDIUM (6.4)
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
Published: 2023-04-28T20:47:46.172Z
Updated: 2025-01-30T18:49:28.930Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29057 vulnerable 2026-06-08 06:02:38.406627 Details available
HIGH (7.3)
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
Published: 2023-04-28T20:53:13.267Z
Updated: 2025-01-30T18:34:12.946Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29056 vulnerable 2026-06-08 06:02:38.365443 Details available
MEDIUM (5.3)
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
Published: 2023-04-28T21:07:40.439Z
Updated: 2025-01-30T18:26:37.319Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25495 vulnerable 2026-06-08 05:56:09.061652 Details available
MEDIUM (4.9)
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
Published: 2023-04-28T21:26:12.202Z
Updated: 2025-01-30T18:25:51.209Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-25492 vulnerable 2026-06-08 05:56:09.030136 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-0683 vulnerable 2026-06-08 05:52:32.420744 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-34888 vulnerable 2026-06-08 05:46:03.955181 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-34884 vulnerable 2026-06-08 05:46:03.907901 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.