CVE-2024-54085: AMI MegaRAC SPx BMC authentication bypass via Redfish Host Interface

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score of 10.0, unauthenticated remote authentication bypass, active exploitation per KEV, and very high EPSS probability make this an urgent patch-first issue.

What it is

AMI's SPx BMC implementation contains an authentication bypass reachable remotely through the Redfish Host Interface, classified as CWE-290 (authentication bypass by spoofing). Because the BMC controls server power, firmware and out-of-band management, a bypass there undermines the integrity of the whole host, and the record lists NetApp hardware firmware among affected products.

Impact

An unauthenticated attacker gains full control of the BMC, with high confidentiality, integrity and availability impact on both the vulnerable system and subsequent systems, meaning potential data theft, firmware tampering, or bricking of the server.

Attack surface

Reachable over the network via the Redfish Host Interface with no privileges and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The description does not specify which interface exposure or configuration is required beyond the Redfish Host Interface.

Exploitation

Listed in CISA KEV with a 2025-06-25 addition and 2025-07-16 remediation due date, and multiple references describe active exploitation; EPSS 30-day probability is 0.60747 (99.1st percentile). No ransomware campaign use is documented in this record.

What to do

• Apply the vendor mitigations in AMI security advisory AMI-SA-2025003 and the NetApp advisory ntap-20250328-0003, or discontinue use of affected products if no fix is available, per CISA's required action.
• Isolate BMC/Redfish management interfaces from untrusted networks and restrict them to a dedicated, access-controlled management VLAN.
• Disable or block the Redfish Host Interface where it is not operationally required.
• Monitor CISA KEV guidance and BOD 22-01 requirements for cloud-connected instances of affected products.
• Inventory all AMI MegaRAC SPx and listed NetApp firmware deployments to confirm which units remain unpatched.

Detection

• Review BMC and Redfish authentication logs for successful sessions that lack a preceding credential exchange or that originate from unexpected source addresses.
• Alert on anomalous BMC activity such as firmware updates, power resets, or user/account changes outside maintenance windows.
• Monitor network traffic to BMC management ports for Redfish Host Interface access from non-management segments.
• Correlate BMC log gaps or restarts with host-side events that could indicate tampering or bricking attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.