CVE-2024-54085
Published: 11 March 2025
Summary
CVE-2024-54085 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Ami Megarac Sp-X. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through application of AMI patches directly eliminates the authentication bypass vulnerability in the SPx BMC Redfish Host Interface.
Boundary protection denies unauthorized remote network access to the vulnerable Redfish Host Interface, blocking exploitation by unauthenticated attackers.
Vulnerability scanning identifies systems with the unpatched CVE-2024-54085 BMC flaw for prioritized remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-54085 enables remote authentication bypass on BMC Redfish interface, facilitating public-facing app exploitation (T1190), remote service exploitation (T1210), local account creation (T1136.001), OS credential dumping via memory access (T1003), network sniffing (T1040), system shutdown/reboot (T1529), firmware corruption (T1495), and component firmware persistence (T1542.002).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
NVD Description
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Deeper analysisAI
CVE-2024-54085 is a vulnerability in AMI's SPx service processor, specifically within the Baseboard Management Controller (BMC), that enables an attacker to bypass authentication remotely via the Redfish Host Interface. Published on 2025-03-11, it is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-290 (Authentication Bypass). Successful exploitation can lead to loss of confidentiality, integrity, and/or availability of the affected system.
The vulnerability can be exploited by any unauthenticated remote attacker over the network with low complexity and no user interaction required. Upon bypassing authentication, an attacker gains unauthorized access to the BMC, potentially achieving high-impact effects including data exposure, modification of system configurations, and disruption of services.
Advisories from AMI (AMI-SA-2025003) and affected vendors like NetApp (ntap-20250328-0003) provide details on mitigation, including available patches and remediation steps for the SPx BMC component.
Multiple reports highlight active real-world exploitation of CVE-2024-54085, including its addition to CISA's Known Exploited Vulnerabilities catalog. Coverage from Ars Technica, Eclypsium, and BleepingComputer notes that it imperils thousands of servers, with attackers able to brick systems via the AMI MegaRAC management tool.
Details
- CWE(s)
- KEV Date Added
- 25 June 2025