ZeroDay Findings
Sign inSign up

Findings

CVE-2024-54085

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Published Mar 11, 2025 · updated Jun 17, 2026 · ami megarac sp-x

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 11, 2025 · Catalog

    Detected

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

  2. Jun 25, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jul 16, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Jul 16, 2025

Affected

  • cpe ami/megarac sp-xversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410c firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/sg110 firmwareversion unspecified
  • cpe netapp/sg1100 firmwareversion unspecified
  • cpe netapp/sg6160 firmwareversion unspecified
  • cpe netapp/sgf6112 firmwareversion unspecified
  • vendor AMI MegaRAC SPxversion unspecified

Sources

  • CISA KEVCVE-2024-54085

    AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

    cisa.gov
  • CVE.orgCVE-2024-54085

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-54085

    30-day exploitation probability 60.7%

    first.org
  • NIST NVDCVE-2024-54085

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

    nvd.nist.gov

References