CVE-2024-54085
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
Description
CVE-2024-54085 is a critical authentication bypass vulnerability in AMI's MegaRAC SP-X Baseboard Management Controller (BMC) firmware. The flaw allows an unauthenticated remote attacker to bypass authentication through the Redfish Host Interface, potentially gaining complete control over server management functions. With a CVSS v3.1 base score of 9.8 (CRITICAL), successful exploitation can lead to total loss of confidentiality, integrity, and availability of the managed server infrastructure. CISA has added CVE-2024-54085 to the Known Exploited Vulnerabilities catalog with a remediation deadline, and its EPSS score of 8.24% at the 92th percentile confirms a high likelihood of active exploitation. The vulnerability affects MegaRAC SP-X versions 12 through 13 and extends to multiple NetApp hardware platforms that rely on AMI's BMC firmware.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ami | megarac sp-x | >= 12, < 12.7; >= 13, < 13.5 |
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | h410s firmware | - |
| netapp | h410c firmware | - |
| netapp | sg6160 firmware | - |
| netapp | sgf6112 firmware | - |
| netapp | sg110 firmware | - |
| netapp | sg1100 firmware | - |
References
- https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf(Vendor Advisory)
- https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/(Press/Media Coverage, Third Party Advisory)
- https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/(Press/Media Coverage, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20250328-0003/(Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/(Press/Media Coverage, Third Party Advisory)
- https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html(Press/Media Coverage, Third Party Advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-54085(US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085(US Government Resource)
Weakness Type
CWE-290: Authentication Bypass by Spoofing
The authentication bypass by spoofing weakness in CVE-2024-54085 allows an attacker to circumvent authentication mechanisms by impersonating a legitimate entity. In AMI's MegaRAC SP-X BMC, the Redfish Host Interface fails to properly verify the authenticity of incoming requests, allowing a remote attacker to gain unauthorized access to critical server management functions without providing valid credentials.
Learn more: CWE-290 — Authentication Bypass by Spoofing
Impact Analysis
The impact of CVE-2024-54085 is catastrophic across all security dimensions. The vulnerability scores the maximum impact ratings with Confidentiality (High), Integrity (High), and Availability (High) all fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), meaning any remote attacker can exploit this vulnerability without any prerequisites. Successful exploitation of the BMC authentication bypass grants the attacker complete control over server management functions, including the ability to read sensitive data, modify firmware and configurations, power cycle servers, and permanently brick hardware. With an EPSS score of 8.2% at the 92th percentile, exploitation is actively occurring. The impact extends across the entire data center infrastructure, as BMC interfaces typically manage critical server hardware used by enterprises and cloud providers.
Exploit Maturity
CVE-2024-54085 demonstrates high exploit maturity, with CISA confirming active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 8.24% at the 92th percentile indicates significant exploitation probability. While no public proof-of-concept exploit code has been tagged in the available references, detailed technical coverage from security researchers at Eclypsium and press coverage from multiple outlets confirm the severity and active targeting of this vulnerability. BMC vulnerabilities are highly prized by advanced threat actors because they provide persistent, hardware-level access that survives operating system reinstallation and disk replacement. The ransomware association is classified as unknown, but the potential for destructive attacks through BMC compromise, including permanent hardware bricking, makes this vulnerability a critical concern.
Remediation
-
Apply firmware updates immediately per the AMI security advisory AMI-SA-2025003. Upgrade MegaRAC SP-X to version 12.7 or later for the 12.x branch, or version 13.5 or later for the 13.x branch. For NetApp appliances, follow the guidance in NetApp advisory NTAP-20250328-0003.
-
Isolate BMC management interfaces on a dedicated, segmented management network (out-of-band management VLAN). BMC interfaces should never be exposed to the internet or general corporate networks. Implement strict firewall rules limiting access to authorized administrative workstations only.
-
Disable the Redfish Host Interface if it is not actively required for server management operations. If the Redfish interface must remain enabled, enforce TLS with certificate-based authentication and restrict access to specific IP ranges.
-
Conduct forensic analysis of BMC access logs for any signs of unauthorized authentication or configuration changes. Check for unauthorized firmware modifications, new user accounts, or changes to IPMI/Redfish configurations that could indicate persistent access.
-
Implement BMC monitoring by integrating BMC event logs with your SIEM platform and setting up alerts for authentication failures, configuration changes, and firmware update events on all managed servers.
Technical Details
CVE-2024-54085 is an authentication bypass vulnerability in AMI's MegaRAC SP-X BMC firmware, specifically in the Redfish Host Interface. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high impact across confidentiality, integrity, and availability. The Redfish protocol provides a RESTful API for hardware management, and the vulnerability exists in how the BMC validates authentication credentials for incoming Redfish requests. An attacker can craft requests that bypass the authentication check entirely, gaining unauthorized access to all BMC management functions. This includes the ability to read and modify server configurations, update firmware, access virtual media, control power states, and interact with the host operating system through the keyboard-video-mouse (KVM) interface. The affected versions span MegaRAC SP-X 12.x (before 12.7) and 13.x (before 13.5), with multiple NetApp storage appliance platforms also vulnerable due to their reliance on AMI's BMC firmware stack.
Frequently Asked Questions
Is CVE-2024-54085 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2024-54085 to the Known Exploited Vulnerabilities catalog. The EPSS score of 8.24% at the 92th percentile confirms a high probability of exploitation. Multiple security outlets have reported on active targeting of this vulnerability.
What products are affected by CVE-2024-54085?
AMI MegaRAC SP-X versions 12.x (before 12.7) and 13.x (before 13.5) are affected. Additionally, multiple NetApp hardware platforms are vulnerable, including H300S, H500S, H700S, H410S, H410C, SG6160, SGF6112, SG110, and SG1100 firmware. Any server using AMI's BMC firmware should be evaluated.
How do I fix CVE-2024-54085?
Update MegaRAC SP-X firmware to version 12.7 or later (12.x branch) or 13.5 or later (13.x branch) per the AMI security advisory. Isolate BMC management interfaces on a dedicated management VLAN and disable the Redfish Host Interface if not required.
How severe is CVE-2024-54085?
CVE-2024-54085 is rated CRITICAL with a CVSS v3.1 score of 9.8 out of 10. The vulnerability allows unauthenticated remote access to complete server management functions, potentially affecting confidentiality, integrity, and availability of the entire server infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.