CVE-2024-54085
📋 TL;DR
CVE-2024-54085 is a critical authentication bypass vulnerability in AMI's SPx BMC firmware that allows remote attackers to gain unauthorized access through the Redfish Host Interface without credentials. This affects servers using vulnerable AMI BMC firmware versions, potentially compromising thousands of enterprise servers and data centers. Successful exploitation can lead to complete system compromise including bricking servers.
💻 Affected Systems
- AMI SPx BMC firmware
- AMI MegaRAC SP-X
- Various OEM servers using AMI BMC firmware
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to brick servers permanently, deploy ransomware, exfiltrate sensitive data, and establish persistent backdoors in data centers.
Likely Case
Attackers gain administrative access to BMC, allowing them to install malware, steal credentials, manipulate firmware, and potentially disrupt server operations.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated management networks, though lateral movement within the management plane remains possible.
🎯 Exploit Status
Actively exploited in the wild according to CISA's Known Exploited Vulnerabilities catalog. Exploitation requires network access to the Redfish interface (typically port 443/HTTPS).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by OEM - check with specific server vendor for patched firmware versions
Vendor Advisory: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
Restart Required: Yes
Instructions:
1. Contact your server vendor for specific patched firmware. 2. Download appropriate firmware update. 3. Apply BMC firmware update following vendor instructions. 4. Reboot the BMC (server may require reboot). 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allIsolate BMC management interfaces from untrusted networks and restrict access to authorized IPs only
Use firewall rules to restrict access to BMC IPs/ports (typically 443, 623, 664) to management networks only
Disable Redfish Interface
allTemporarily disable Redfish interface if not required for operations
Check BMC configuration for Redfish disable option - varies by vendor
🧯 If You Can't Patch
- Implement strict network access controls to BMC interfaces allowing only from trusted management networks
- Monitor BMC logs for unauthorized access attempts and implement intrusion detection for BMC management traffic
🔍 How to Verify
Check if Vulnerable:
Check BMC firmware version against vendor advisories. Attempt to access Redfish interface without authentication to test for bypass (use caution).Check Version:
ipmitool mc info | grep 'Firmware Revision' or check via vendor-specific BMC management toolsVerify Fix Applied:
Verify BMC firmware version matches patched version from vendor. Test that authentication is required for Redfish interface access.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated Redfish API calls in BMC logs
- Failed authentication attempts followed by successful access
- Unusual BMC configuration changes
Network Indicators:
- Unusual traffic to BMC management ports (443, 623) from unauthorized sources
- Redfish API calls without authentication headers
SIEM Query:
source="bmc_logs" AND (event="authentication_bypass" OR (auth_result="failure" AND subsequent_event="success"))🔗 References
- https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf
- https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/
- https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/
- https://security.netapp.com/advisory/ntap-20250328-0003/
- https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/
- https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-54085
- https://security.netapp.com/advisory/ntap-20250328-0003/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085
