Database/Firmware, BMC & network fabric
AMI MegaRAC SPx (Redfish Host Interface): **[KEV]** Unauthenticated auth bypass, full BMC takeover, malicious firmware
Impact
**[KEV]** Unauthenticated auth bypass, full BMC takeover, malicious firmware flash. Persists below the OS and survives reimaging
Who can reach it
Network / Redfish host interface, unauthenticated
What to do
Out-of-band BMC flash on every node; requires an ODM rebase of the AMI fix (Supermicro / Lenovo / HPE / ASRock each ship their own build, availability lags AMI by months), bricking risk on interrupted flash
Fleet impact
How widespread
universal - AMI MegaRAC is the OEM BMC stack shipped under most Supermicro/ASRock Rack/Gigabyte/Quanta GPU servers
Cost to remediate
firmware-flash - BMC firmware image per node, applied out-of-band, and the OEM must first rebase AMI's fix into its own build; realistically a rolling node-drain because a bad flash bricks the board
Why it hits the whole fleet
Unauthenticated Redfish auth bypass by spoofing the X-Server-Addr/Host header gives full BMC takeover on every node running the same OEM image; the BMC sits below the hypervisor, so an implant survives OS reimaging and GPU node rebuilds. First BMC CVE ever added to CISA KEV (2025-06-25).
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.