AMI MegaRAC SPx (Redfish Host Interface): Unauthenticated auth bypass, full BMC takeover, malicious firmware flash.

CVSS 9.8CVE-2024-54085Firmware, BMC & network fabricKnown exploitedcurated

Impact

Unauthenticated auth bypass, full BMC takeover, malicious firmware flash. Persists below the OS and survives reimaging

Who can reach it

Network / Redfish host interface, unauthenticated

What to do

Out-of-band BMC flash on every node; requires an ODM rebase of the AMI fix (Supermicro / Lenovo / HPE / ASRock each ship their own build, availability lags AMI by months), bricking risk on interrupted flash

Fleet impact

How widespread

universal - AMI MegaRAC is the OEM BMC stack shipped under most Supermicro/ASRock Rack/Gigabyte/Quanta GPU servers

Cost to remediate

firmware-flash - BMC firmware image per node, applied out-of-band, and the OEM must first rebase AMI's fix into its own build; realistically a rolling node-drain because a bad flash bricks the board

Why it hits the whole fleet

Unauthenticated Redfish auth bypass by spoofing the X-Server-Addr/Host header gives full BMC takeover on every node running the same OEM image; the BMC sits below the hypervisor, so an implant survives OS reimaging and GPU node rebuilds. First BMC CVE ever added to CISA KEV (2025-06-25).

References

https://nvd.nist.gov/vuln/detail/CVE-2024-54085

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.