CVE-2024-54085
CriticalActively exploited (CISA KEV)
Description
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAMI MegaRAC SPx
PublishedMar 11, 2025
First seenMar 11, 2025
Added to KEVJun 25, 2025
Weakness typeCWE-290CWE-290
How to fix
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Jul 16, 2025Update
- ami megarac_sp-x12.7, 13.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ami megarac_sp-x | 12 ≤ v < 12.7, 13 ≤ v < 13.5 | 12.7, 13.5 |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| netapp h410c_firmware | No range specified | — |
| netapp sg6160_firmware | No range specified | — |
| netapp sgf6112_firmware | No range specified | — |
| netapp sg110_firmware | No range specified | — |
| netapp sg1100_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.