CVE-2024-54085

🗓️ 11 Mar 2025 14:15:22Reported by [email protected]Type

CVE-2024-54085 in AMI's SPx allows remote authentication bypass via Redfish Host Interface.

Reporter	Title	Published	Views	Family All 25
attackerkb	CVE-2024-54085	11 Mar 202500:00	–	attackerkb
BDU FSTEC	AMI MegaRAC SP-X Authentication Bypass	23 Jun 202500:00	–	bdu_fstec
Broadcom	AMI Security Advisory AMI-SA-2025003 (CVE-2024-54084,CVE-2024-54085)	1 May 202500:00	–	broadcom
Circl	CVE-2024-54085	11 Mar 202514:33	–	circl
CISA KEV Catalog	AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability	25 Jun 202500:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	25 Jun 202512:00	–	cisa
CNNVD	AMI MegaRAC security vulnerabilities	11 Mar 202500:00	–	cnnvd
CVE	CVE-2024-05485	11 Mar 202500:00	–	cve
CVE	CVE-2024-54085	11 Mar 202514:00	–	cve
Cvelist	CVE-2024-54085 Redfish Authentication Bypass	11 Mar 202514:00	–	cvelist

NVD

Node

ami megarac_sp-xRange12–12.7

ami megarac_sp-xRange13–13.5

Node

AND

netapp h300s_firmwareMatch-

netapp h300sMatch-

Node

AND

netapp h500s_firmwareMatch-

netapp h500sMatch-

Node

AND

netapp h700s_firmwareMatch-

netapp h700sMatch-

Node

AND

netapp h410s_firmwareMatch-

netapp h410sMatch-

Node

AND

netapp h410c_firmwareMatch-

netapp h410cMatch-

Node

AND

netapp sg6160_firmwareMatch-

netapp sg6160Match-

Node

AND

netapp sgf6112_firmwareMatch-

netapp sgf6112Match-

Node

AND

netapp sg110_firmwareMatch-

netapp sg110Match-

Node

AND

netapp sg1100_firmwareMatch-

netapp sg1100Match-

Source	Link
go	www.go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
bleepingcomputer	www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/
security	www.security.netapp.com/advisory/ntap-20250328-0003/
arstechnica	www.arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-54085
networkworld	www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html
eclypsium	www.eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/

17 Jun 2026 08:09Current

CVSS 3.19.8

CVSS 410

EPSS0.60747

SSVC

CWE-290