Actively exploited · Published Mar 11, 2025 · Assigned by AMI
CVE-2024-54085Redfish Authentication Bypass
Critical 10.0 Exploited
In plain English
A critical-severity authentication bypass by spoofing in MegaRAC-SPx from AMI. Attackers are actively exploiting it in the wild (listed by CISA on June 25, 2025). The chance it is exploited in the next 30 days is estimated at 60.7% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jul 16, 2025.
Official description
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AMI | MegaRAC-SPx | 12.0 – before 12.713.0 – before 13.5 |
Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
- https://security.netapp.com/advisory/ntap-20250328-0003/ third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-54085 government-resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085 government-resource
- https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/
- https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/
- https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/
- https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html