CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

CVE-2024-54085 is an authentication bypass by spoofing vulnerability in AMI MegaRAC SPx, specifically affecting the Redfish Host Interface. Successful exploitation can allow an attacker to bypass authentication controls, potentially resulting in loss of confidentiality, integrity, and/or availability of the affected system. This matters for IT and security teams because MegaRAC SPx commonly provides baseboard management controller (BMC) functionality on enterprise servers, giving out-of-band access that, if compromised, can undermine host security even when the main operating system remains intact. Confirm all product details and impact against the vendor advisory.

How it works

The vulnerability is classified as CWE-290, Authentication Bypass by Spoofing. In this class of flaw, an attacker can impersonate a legitimate entity or source to circumvent authentication checks that the system relies upon. For AMI MegaRAC SPx, the issue resides in the Redfish Host Interface, a management protocol commonly used for remote server administration. An attacker who can reach the interface may spoof authentication material or identity attributes that the BMC accepts as valid, thereby gaining unauthorized access without legitimate credentials. Public detail on exact spoofing mechanics is limited; treat any exploitation claims as requiring confirmation against the vendor advisory. Once authentication is bypassed, the attacker could interact with management functions that control power, firmware, sensors, or other host resources, leading to the confidentiality, integrity, or availability impacts noted by CISA.

Am I affected? How to find it in your systems

AMI MegaRAC SPx typically runs as BMC firmware on servers from multiple hardware vendors that integrate AMI management controllers. Inventory efforts should focus on out-of-band management interfaces rather than the host OS alone. Check server asset records, BMC web consoles, Redfish endpoints, and vendor management tools for the presence of MegaRAC SPx. Examine firmware version strings reported by the BMC or Redfish service and compare them against the fixed versions listed in the AMI advisory; do not rely on assumed version ranges. Network scans that identify Redfish services (commonly on dedicated management ports or VLANs) can surface candidates for deeper inspection. Review configuration for Host Interface exposure and any authentication settings that might interact with the vulnerable path. Log and telemetry signs of exploitation are not detailed in public summaries; look for unexpected Redfish sessions, authentication anomalies, or management actions originating from untrusted sources, then validate findings against vendor guidance. Cloud or hosted environments using the product should also follow applicable BOD 22-01 considerations.

How to remediate

Apply the vendor-supplied update for AMI MegaRAC SPx as the primary remediation, following the exact instructions in the AMI advisory. Confirm the fixed firmware revision and any required update procedure for your hardware platform, because OEMs often repackage AMI code. After patching, re-inventory BMC versions to verify the update took effect and re-enable only necessary management interfaces. For this authentication-bypass class, harden remaining exposure by enforcing strong authentication where configurable, restricting Redfish Host Interface access to trusted management networks, and disabling unused management features. Document the change and monitor for residual anomalous activity. If mitigations are unavailable for a given deployment, CISA guidance includes discontinuing use of the product.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls. Segment BMC and Redfish interfaces onto isolated management networks that are unreachable from general user or production segments; block external and lateral access with firewall rules or ACLs. Consider virtual patching or WAF rules that detect and drop anomalous Redfish authentication attempts if your tooling supports the protocol, while recognizing that such measures are imperfect for spoofing flaws. Disable the Redfish Host Interface or related features if operationally feasible. Increase monitoring of management-plane traffic, authentication events, and configuration changes; alert on any unexpected BMC activity. These steps lower likelihood and impact but do not replace the patch. Follow vendor instructions for any temporary workarounds and reassess regularly.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities on management interfaces can lead to broader system compromise and data exposure even when ransomware use has not been documented for this CVE. Treat any confirmed exploitation as a potential incident: isolate affected hosts, preserve BMC and host logs, and investigate for unauthorized access or lateral movement. Organizations can also run a free exposure scan of their email addresses against known breach data sets to determine whether credentials or personal information have appeared in prior incidents, then prioritize password resets and monitoring accordingly.