{"id":"CVE-2024-54085","kind":"vulnerability","aliases":["CVE-2024-54085"],"related":[],"title":"AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the…","description":"AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"AMI MegaRAC SPx, the baseboard management controller firmware used in many servers, has an authentication bypass in its Redfish Host Interface that lets an attacker get past login by spoofing. Per CISA it is being exploited in the wild, and the sources say an exploit may expose confidentiality, integrity, and availability.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2025-06-25T00:00:00+00:00","products":[{"name":"AMI MegaRAC SPx","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ami megarac sp-x","fixed":["12.7"],"affected":">= 12, < 12.7","ecosystem":"vendor"},{"name":"ami megarac sp-x","fixed":["13.5"],"affected":">= 13, < 13.5","ecosystem":"vendor"},{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp sg6160 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp sgf6112 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp sg110 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp sg1100 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ami-megarac","bmc","data-center","exploited","infrastructure","servers"],"not_affected_if":["no-ami-megarac-spx-bmc"],"how_to_check":null,"fix":"Apply the mitigations from the vendor (AMI) as CISA directs, or stop using the affected product if mitigations are unavailable.\nFixed firmware version: unknown","status":"open","published_at":"2025-03-11T14:15:22+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:52+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor (AMI) as CISA directs, or stop using the affected product if mitigations are unavailable.\nFixed firmware version: unknown","reach":"unknown","summary":"AMI MegaRAC SPx, the baseboard management controller firmware used in many servers, has an authentication bypass in its Redfish Host Interface that lets an attacker get past login by spoofing. Per CISA it is being exploited in the wild, and the sources say an exploit may expose confidentiality, integrity, and availability.","category":"infrastructure","who_cares":["bmc","servers","data-center","ami-megarac"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker bypasses BMC authentication and gains control of server management functions.","analyst_note":"Find AMI's advisory and affected/fixed firmware versions and the exact Redfish Host Interface check; source only links the CISA KEV catalog.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ami-megarac-spx-bmc"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2576,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':167C '-2024':18A,21A '-54085':19A,22A '22':166C 'action':157C 'ami':1A,23A,26A,31A,64B,73B,124C 'ami-megarac':63B 'and/or':153C 'appli':158C 'applic':164C 'attack':12A,97B 'authent':15A,87B,129C 'avail':123B,154C 'baseboard':77B 'bmc':9A,66B 'bod':165C 'bypass':14A,88B,130C 'center':69B 'cisa':104B,155C 'cloud':170C 'confidenti':120B,151C 'contain':4A,127C 'control':79B 'cve':17A,20A 'data':68B 'data-cent':67B 'discontinu':173C 'exploit':70B,108B,117B,141C 'expos':119B 'firmwar':80B 'firmware':38A,41A,44A,47A,50A,53A,56A,59A,62A 'follow':163C 'get':98B 'guidanc':168C 'h300s':37A 'h410c':49A 'h410s':46A 'h500s':40A 'h700s':43A 'host':92B,137C 'infrastructur':71B 'instruct':162C 'integr':121B,152C 'interfac':93B,138C 'lead':146C 'let':95B 'login':100B 'loss':149C 'manag':78B 'mani':83B 'may':13A,118B,145C 'megarac':24A,27A,32A,65B,74B,125C 'mitig':159C,179C 'netapp':36A,39A,42A,45A,48A,51A,54A,57A,60A 'past':99B 'per':103B,160C 'product':177C 'redfish':91B,136C 'remot':16A 'requir':156C 'say':115B 'server':72B,84B 'servic':171C 'sg110':58A 'sg1100':61A 'sg6160':52A 'sgf6112':55A 'sourc':114B 'sp':29A,34A 'sp-x':28A,33A 'spoof':102B,132C 'spx':3A,25A,75B,126C 'success':140C 'unavail':181C 'use':81B,174C 'vendor':161C 'vulner':6A,133C,144C 'wild':111B 'x':30A,35A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-11T14:15:22+00:00","kev":{"dateAdded":"2025-06-25","dueDate":"2025-07-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"biossecurity@ami.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-54085","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085","severity":null,"published_at":"2025-06-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-54085","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54085","severity":null,"published_at":"2025-03-11T14:15:22+00:00","modified_at":"2026-06-17T08:09:44+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}