6.7

CVE-2024-45105

An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorlenovo
≫
Product thinkagile_hx5530_firmware
Default Statusunaffected
Version < afe130c
Version 0
Status affected
Vendorlenovo
≫
Product thinkedge_se450__firmware
Default Statusunaffected
Version < cme116d
Version 0
Status affected
Vendorlenovo
≫
Product thinkedge_se350_v2_firmware
Default Statusunaffected
Version < iye110f
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_st250_v3_firmware
Default Statusunaffected
Version < cte110i
Version 0
Status affected
Vendorlenovo
≫
Product thinkagile_hx3375_firmware
Default Statusunaffected
Version < d8e138d
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sr950_v3_firmware
Default Statusunaffected
Version < ebe108h
Version 0
Status affected
Vendorlenovo
≫
Product thinkagile_hx650_v3_firmware
Default Statusunaffected
Version < ese126h
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sd530_v3_firmware
Default Statusunaffected
Version < fne118d
Version 0
Status affected
Vendorlenovo
≫
Product thinkagile_hx645_v3_integrated_system_firmware
Default Statusunaffected
Version < kae120j
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sr850_v2_firmware
Default Statusunaffected
Version < m5e128i
Version 0
Status affected
Vendorlenovo
≫
Product thinkedge_se455_v3_firmware
Default Statusunaffected
Version < mbe110h
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sd665_v3_firmware
Default Statusunaffected
Version < qge124h
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sr850_v3_firmware
Default Statusunaffected
Version < rse110h
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sr250_v2_firmware
Default Statusunaffected
Version < tqe116c
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sd630_v2_firmware
Default Statusunaffected
Version < u8e128l
Version 0
Status affected
Vendorlenovo
≫
Product thinksystem_sd650_v3_firmware
Default Statusunaffected
Version < use130g
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.081
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@lenovo.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-825 Expired Pointer Dereference

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.