{"id":"CVE-2024-54085","published":"2025-03-11T14:15:22Z","modified":"2026-06-17T08:09:44Z","title":"AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability","vendor":"AMI","product":"MegaRAC SPx","tier":"core","eol":null,"description":{"text":"AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.","provenance":"source","from":"NVD"},"summary":{"text":"AMI MegaRAC SPx contains an authentication bypass flaw in its baseboard management controller (BMC), reachable through the Redfish Host Interface. An attacker can bypass authentication by spoofing, and the attack can be carried out remotely without privileges or user interaction, potentially leading to loss of confidentiality, integrity, and/or availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:00Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.60747,"percentile":0.99146,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-06-25","dueDate":"2025-07-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf ; https://security.netapp.com/advisory/ntap-20250328-0003/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-54085","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-06-25","exploitedFirstSeen":"2025-06-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-06-25"},{"url":"https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/","date":"2025-06-26"},{"url":"https://eclypsium.com/blog/white-house-ai-cybersecurity-plan-takeaways/","date":"2025-08-05"},{"url":"https://www.kelacyber.com/resources/research/2025_midyear_threat_report/","date":"2025-08-08"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"references":[{"url":"https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf","tags":["Vendor Advisory"]},{"url":"https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0003/","tags":["Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54085","tags":["US Government Resource"]},{"url":"https://security.netapp.com/advisory/ntap-20250328-0003/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.","confidence":"high"},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.","confidence":"high"},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.","confidence":"high"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.","confidence":"high"},{"id":"T1608.001","name":"Upload Malware","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-54252","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54252","exploited":true,"exploitedSince":"2025-06-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-06-29","earliestUrl":"https://github.com/Mr-Zapi/CVE-2024-54085","repos":[{"name":"Mr-Zapi/CVE-2024-54085","url":"https://github.com/Mr-Zapi/CVE-2024-54085","stars":2,"created":"2025-06-29"}]},"first":{"date":"2025-06-29","source":"PoC-in-GitHub","url":"https://github.com/Mr-Zapi/CVE-2024-54085"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1608.001","T1210","T1495","T1499"],"provenance":"source"}],"timeline":[{"date":"2025-03-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54085","provenance":"source"},{"date":"2025-06-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-06-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-06-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54252","provenance":"source"},{"date":"2025-06-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Mr-Zapi/CVE-2024-54085","provenance":"source"}],"speed":{"daysToPublicExploit":110,"firstExploitFrom":"PoC-in-GitHub","daysToKev":106},"priority":{"score":69.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 492 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9915"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}