Log in Start free

Vulnerability · Published Sep 13, 2024 · Assigned by lenovo

CVE-2024-45105

Medium 6.7

In plain English

A medium-severity security flaw in HX1331 Certified Node (ThinkAgile) BIOS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.2%top 93.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.

Affected products (as reported)

VendorProductVersions
Lenovo HX5530 Appliance (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX645 V3 Integrated System (ThinkAgile) BIOS 0 – before KAE120J
Lenovo HX665 V3 Certified Node (ThinkAgile) BIOS 0 – before KAE120J
Lenovo ST250 V3 (ThinkSystem) BIOS 0 – before CTE110I
Lenovo VX3331 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX1331 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX2330 Appliance (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX2331 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX3330 Appliance (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX3331 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX3331 Node SAP HANA (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX3375 Appliance (ThinkAgile) BIOS 0 – before D8E138D
Lenovo HX3376 Certified Node (ThinkAgile) BIOS 0 – before D8E138D
Lenovo HX5531 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX630 V3 Certified Node (ThinkAgile) BIOS 0 – before ESE126H
Lenovo HX630 V3 Integrated System (ThinkAgile) BIOS 0 – before ESE126H
Lenovo HX645 V3 Certified Node (ThinkAgile) BIOS 0 – before KAE120J
Lenovo HX650 V3 Certified Node (ThinkAgile) BIOS 0 – before ESE126H
Lenovo HX650 V3 Integrated System (ThinkAgile) BIOS 0 – before ESE126H
Lenovo HX665 V3 Integrated System (ThinkAgile) BIOS 0 – before KAE120J
Lenovo HX665 V3 Storage Certified Node (ThinkAgile) BIOS 0 – before KAE120J
Lenovo HX665 V3 Storage Integrated Node (ThinkAgile) BIOS 0 – before KAE120J
Lenovo HX7530 Appl for SAP HANA (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX7531 Certified Node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo HX7531 Node SAP HANA (ThinkAgile) BIOS 0 – before AFE130C
Lenovo MX3330-F All-flash Appliance (ThinkAgile) BIOS 0 – before AFE130C
Lenovo MX3330-H Hybrid Appliance (ThinkAgile) BIOS 0 – before AFE130C
Lenovo MX3331-F All-flash Certified node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo MX3331-H Hybrid Certified node (ThinkAgile) BIOS 0 – before AFE130C
Lenovo MX3530 F All flash Appliance (ThinkAgile) BIOS 0 – before AFE130C

Weakness: CWE-825 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References