CVE-2024-45105

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-13 · updated 2026-06-17
Weakness: CWE-825

Description

An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.

Affected products

Lenovo Thinkagile Vx650 V3 Certified Node Firmware: before ese126h — fixed in ese126h
Lenovo Thinkagile Vx665 V3 Certified Node Firmware: before kae120j — fixed in kae120j
Lenovo Thinkagile Vx7531 Firmware: before afe130c — fixed in afe130c
Lenovo Thinkedge Se360 V2 Firmware: before iye110f — fixed in iye110f
Lenovo Thinkedge Se450 Firmware: before cme116d — fixed in cme116d
Lenovo Thinkedge Se455 V3 Firmware: before mbe110h — fixed in mbe110h
Lenovo Thinksystem Sd550 V3 Firmware: before fne118d — fixed in fne118d
Lenovo Thinksystem Sr665 Firmware: before d8e138d — fixed in d8e138d
Lenovo Thinksystem Sr675 V3 Firmware: before qge124h — fixed in qge124h
Lenovo Thinksystem Sr860 V2 Firmware: before m5e128i — fixed in m5e128i
Lenovo Thinksystem Sr860 V3 Firmware: before rse110h — fixed in rse110h
Lenovo Thinksystem Sr950 V3 Firmware: before ebe108h — fixed in ebe108h
Lenovo Thinksystem St258 V2 Firmware: before tqe116c — fixed in tqe116c
Lenovo Thinksystem St258 V3 Firmware: before cte110i — fixed in cte110i
Lenovo Thinksystem St658 V2 Firmware: before u8e128l — fixed in u8e128l
Lenovo Thinksystem St658 V3 Firmware: before use130g — fixed in use130g

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Vx650 V3 Certified Node Firmware ese126h; Lenovo Thinkagile Vx665 V3 Certified Node Firmware kae120j; Lenovo Thinkagile Vx7531 Firmware afe130c; Lenovo Thinkedge Se360 V2 Firmware iye110f; Lenovo Thinkedge Se450 Firmware cme116d; Lenovo Thinkedge Se455 V3 Firmware mbe110h; Lenovo Thinksystem Sd550 V3 Firmware fne118d; Lenovo Thinksystem Sr665 Firmware d8e138d; Lenovo Thinksystem Sr675 V3 Firmware qge124h; Lenovo Thinksystem Sr860 V2 Firmware m5e128i; Lenovo Thinksystem Sr860 V3 Firmware rse110h; Lenovo Thinksystem Sr950 V3 Firmware ebe108h. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-165524

Get alerted when CVE-2024-45105 or the next vulnerability affects your stack