CVE-2024-54085
About
AMI’s SPx contains
a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability.
Rainforest analyst review
AMI's MegaRAC SP-x BMC firmware contains an authentication bypass in its Redfish host interface: an attacker reaching the management API remotely can bypass the authentication check entirely and gain administrative control of the baseboard management controller. The BMC is a separate always-on processor with total control over the server, so bypassing its auth means power control, firmware reflashing, virtual media, and console access without any valid credentials.
MegaRAC is OEM'd into servers from many major hardware vendors and into storage systems such as NetApp's, so a single firmware flaw propagates across a huge, diverse fleet of datacenter hardware. BMCs are meant to live on isolated management networks but are frequently reachable more broadly than operators assume, and compromise there is durable and stealthy because it sits beneath the operating system. It is on CISA's KEV list. Apply the fixed firmware from your server or storage vendor, and structurally, ensure BMC/IPMI/Redfish interfaces are on a segregated management network with no exposure to production or the internet, since firmware-level access survives OS reinstalls and is hard to detect after the fact.
References
- https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
- https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/
- https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/
- https://security.netapp.com/advisory/ntap-20250328-0003/
- https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/
- https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-54085
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085
Related CVEs
Frequently asked questions
What is CVE-2024-54085?
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
How severe is CVE-2024-54085?
CVE-2024-54085 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2024-54085 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2024-54085?
Public advisories list the following as affected: h300s, h300s firmware, h410c, h410c firmware, h410s, h410s firmware, +13. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-54085?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.