CVE-2024-4550

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Lenovo	P360 Workstation (ThinkStation) BIOS	<= S0EKT43A
Lenovo	ST50 (ThinkSystem) BIOS	< ITE134A
Lenovo	ST50 V2 (ThinkSystem) BIOS	< TOE112D
Lenovo	ST58 (ThinkSystem) BIOS	< ITE134A
Lenovo	ST58 V2 (ThinkSystem) BIOS	< TOE112D
lenovo	thinkstation_p360_workstation_firmware	< s0ekt43a
lenovo	thinksystem_st50_firmware	< ite134a
lenovo	thinksystem_st50_v2_firmware	< toe112d
lenovo	thinksystem_st58_v2_firmware	< toe112d
lenovo	thinksystem_st58_firmware	< ite134a

References

https://support.lenovo.com/us/en/product_security/LEN-165524

Timeline

Published: Sep 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-455046.5Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthentic CVE-2024-455058.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vu CVE-2024-455067.5HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwardin CVE-2024-455079.8Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue aff CVE-2024-455089.8HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a w CVE-2024-455096.5In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the us CVE-2024-45518.8The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions u CVE-2024-455105.4An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scriptin CVE-2024-455115.4An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcas CVE-2024-455125.4An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a fold CVE-2024-455134.8An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/CVE-2024-455145.4An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoin