10.0
Critical
CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-290
Description
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MegaRAC-SPx 13.0 | 13.0 → < 13.5 | 13.5 |
| MegaRAC-SPx 12.0 | 12.0 → < 12.7 | 12.7 |