CVE-2024-54085 is an authentication-bypass-by-spoofing flaw (CWE-290) in the Redfish Host Interface of AMI's MegaRAC SPx BMC firmware: an attacker can forge HTTP headers such as X-Server-Addr or Host so the BMC believes the request came from the trusted host operating system rather than the network, letting a remote, unauthenticated attacker reach privileged Redfish management functions and take full administrative control of the server's BMC — including the ability to flash malicious firmware, brick the board, or pivot deeper into the management network.
Vulnerability summary
9.8
Critical
60.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-03-11
Published
Vulnerability ID: CVE-2024-54085 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| AMI MegaRAC SP-x BMC firmware | cpe:2.3:o:ami:megarac_sp-x:*:*:*:*:*:*:*:* | 12.0 up to (not including) 12.7; 13.0 up to (not including) 13.5, per NVD CPE applicability data |
| NetApp H-Series controllers / SG-Series StorageGRID appliances (bundled AMI MegaRAC SP-x BMC) | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | All firmware builds for NetApp H300S, H410C, H410S, H500S, H700S controllers and SG110, SG1100, SG6160, SGF6112 StorageGRID appliances that bundle the vulnerable MegaRAC SP-x BMC component, per NetApp Security Advisory ntap-20250328-0003 |
What this means
CVE-2024-54085 is an authentication bypass by spoofing vulnerability (CWE-290). NVD's description states: "AMI's SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability" (NVD).
NVD has published its own independent Primary CVSS metric: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required. AMI's own CNA submission separately scores the issue under CVSS v4.0 at 10.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), which NVD records as a Secondary metric alongside its own v3.1 Primary score (NVD).
Firmware security researcher Eclypsium, which discovered and disclosed the issue, explains that the vulnerable Redfish Host Interface trusts request headers like X-Server-Addr or Host to decide whether a request originates from the local host rather than the network; an attacker who can spoof those header values is treated as a locally-authenticated host process and granted full administrative access to the BMC, with no credentials required. Eclypsium reports the affected MegaRAC firmware is licensed and bundled by numerous server and storage vendors — including HPE, Lenovo, ASUS and NetApp — and that CISA's addition of this CVE marked the first time a BMC vulnerability was added to the Known Exploited Vulnerabilities catalog (Eclypsium). NetApp's own advisory confirms the flaw affects the MegaRAC SP-x component bundled into firmware for its H300S, H410C, H410S, H500S and H700S storage controllers and SG110, SG1100, SG6160 and SGF6112 StorageGRID appliances (NetApp Security Advisory ntap-20250328-0003).
CISA added CVE-2024-54085 to the Known Exploited Vulnerabilities catalog on 2025-06-25, with a required-action due date of 2025-07-16 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.6075 (99.146th percentile), consistent with a vulnerability affecting widely-deployed, often internet- or management-network-exposed BMC firmware (FIRST EPSS).
Because BMCs operate below the host operating system and can persist across OS reinstalls, any affected MegaRAC SP-x deployment — whether branded AMI, or bundled into OEM server/storage firmware such as NetApp's — should be updated to a fixed firmware build from the hardware vendor, have BMC management interfaces isolated from untrusted networks, and be checked for signs of unauthorized configuration or firmware changes given the documented active exploitation.
Evidence
- Authentication bypass in the Redfish Host Interface of AMI MegaRAC SPx BMC firmware lets a remote attacker bypass authentication and compromise confidentiality, integrity and/or availability of the BMC. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; AMI's own CNA submission separately rates it CVSS v4.0 10.0 (Secondary). — NVD
- Root cause: the BMC trusts spoofable headers (e.g. X-Server-Addr, Host) to decide a request is from the trusted host, letting an unauthenticated network attacker gain full BMC admin access; affected MegaRAC firmware is bundled by HPE, Lenovo, ASUS, NetApp and others; this was the first BMC CVE added to CISA KEV. — Eclypsium
- NetApp confirms the vulnerable AMI MegaRAC SP-x BMC component is bundled into firmware for its H300S/H410C/H410S/H500S/H700S controllers and SG110/SG1100/SG6160/SGF6112 StorageGRID appliances. — NetApp Security Advisory ntap-20250328-0003
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-06-25, required-action due date 2025-07-16. — CISA KEV
- EPSS score is 0.6075 (99.146th percentile) as of 2026-10-29. — FIRST EPSS
