CVE-2024-54085

🗓️ 11 Mar 2025 14:00:58Reported by AMIType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 255 Views

Vulnerability in AMI’s SPx BMC allows remote authentication bypass via Redfish Host Interface.

Reporter	Title	Published	Views	Family All 24
attackerkb	CVE-2024-54085	11 Mar 202500:00	–	attackerkb
BDU FSTEC	AMI MegaRAC SP-X Authentication Bypass	23 Jun 202500:00	–	bdu_fstec
Broadcom	AMI Security Advisory AMI-SA-2025003 (CVE-2024-54084,CVE-2024-54085)	1 May 202500:00	–	broadcom
Circl	CVE-2024-54085	11 Mar 202514:33	–	circl
CISA KEV Catalog	AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability	25 Jun 202500:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	25 Jun 202512:00	–	cisa
CNNVD	AMI MegaRAC 安全漏洞	11 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-54085 Redfish Authentication Bypass	11 Mar 202514:00	–	cvelist
EUVD	EUVD-2024-54252	11 Mar 202514:00	–	euvd
F5 Networks	K000152749: AMI’s SPx vulnerability CVE-2024-54085	25 Jul 202513:45	–	f5

NVD

Node

ami megarac_sp-xRange12–12.7

ami megarac_sp-xRange13–13.5

Node

AND

netapp h300s_firmwareMatch-

netapp h300sMatch-

Node

AND

netapp h500s_firmwareMatch-

netapp h500sMatch-

Node

AND

netapp h700s_firmwareMatch-

netapp h700sMatch-

Node

AND

netapp h410s_firmwareMatch-

netapp h410sMatch-

Node

AND

netapp h410c_firmwareMatch-

netapp h410cMatch-

Node

AND

netapp sg6160_firmwareMatch-

netapp sg6160Match-

Node

AND

netapp sgf6112_firmwareMatch-

netapp sgf6112Match-

Node

AND

netapp sg110_firmwareMatch-

netapp sg110Match-

Node

AND

netapp sg1100_firmwareMatch-

netapp sg1100Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "MegaRAC-SPx",
    "vendor": "AMI",
    "versions": [
      {
        "lessThan": "12.7",
        "status": "affected",
        "version": "12.0",
        "versionType": "RC"
      },
      {
        "lessThan": "13.5",
        "status": "affected",
        "version": "13.0",
        "versionType": "RC"
      }
    ]
  }
]

Source	Link
go	www.go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
bleepingcomputer	www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/
security	www.security.netapp.com/advisory/ntap-20250328-0003/
arstechnica	www.arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-54085
networkworld	www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html
eclypsium	www.eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/