---
id: "CVE-2024-54085"
kind: "vulnerability"
aliases: ["CVE-2024-54085"]
title: "AMI\u2019s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "AMI MegaRAC SPx", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ami megarac sp-x", "fixed": ["12.7"], "affected": ">= 12, < 12.7", "ecosystem": "vendor"}, {"name": "ami megarac sp-x", "fixed": ["13.5"], "affected": ">= 13, < 13.5", "ecosystem": "vendor"}, {"name": "netapp h300s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h500s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h700s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410c firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp sg6160 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp sgf6112 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp sg110 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp sg1100 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ami-megarac", "bmc", "data-center", "exploited", "infrastructure", "servers"]
not_affected_if: ["no-ami-megarac-spx-bmc"]
published_at: "2025-03-11T14:15:22+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54085", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the…

AMI MegaRAC SPx, the baseboard management controller firmware used in many servers, has an authentication bypass in its Redfish Host Interface that lets an attacker get past login by spoofing. Per CISA it is being exploited in the wild, and the sources say an exploit may expose confidentiality, integrity, and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AMI MegaRAC SPx affected ? fixed ?
- vendor:ami megarac sp-x affected >= 12, < 12.7 fixed 12.7
- vendor:ami megarac sp-x affected >= 13, < 13.5 fixed 13.5
- vendor:netapp h300s firmware affected ? fixed ?
- vendor:netapp h500s firmware affected ? fixed ?
- vendor:netapp h700s firmware affected ? fixed ?
- vendor:netapp h410s firmware affected ? fixed ?
- vendor:netapp h410c firmware affected ? fixed ?
- vendor:netapp sg6160 firmware affected ? fixed ?
- vendor:netapp sgf6112 firmware affected ? fixed ?
- vendor:netapp sg110 firmware affected ? fixed ?
- vendor:netapp sg1100 firmware affected ? fixed ?

## Fix

Apply the mitigations from the vendor (AMI) as CISA directs, or stop using the affected product if mitigations are unavailable.
Fixed firmware version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-54085
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-54085

## From the sources

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_