Historical catalog analysis: CISA added this entry on June 25, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2024-54085 is an authentication bypass vulnerability (CWE-290) identified in the AMI MegaRAC SPx firmware. The flaw exists within the Redfish Host Interface, a standard used for out-of-band management of server hardware. If exploited, this vulnerability could allow an unauthorized actor to bypass authentication mechanisms via spoofing, potentially leading to a loss of confidentiality, integrity, or availability of the affected system.
Exposure and applicability
This vulnerability affects the AMI MegaRAC SPx BMC firmware. Because BMCs are embedded components used by various hardware OEMs, this flaw may be present across multiple server brands and models utilized in industrial environments.
In an operational technology (OT) context, the risk is highest where these servers function as critical infrastructure components, such as:
* SCADA Servers: Centralized control and monitoring systems.
* Historians: Databases recording long-term process data.
* Engineering Workstations: Systems used to configure PLCs and other industrial controllers.
Exposure occurs if the Redfish Host Interface is accessible over the network. Because BMCs operate independently of the primary operating system, a compromise at this layer provides low-level hardware control that bypasses traditional OS-level security software.
Remediation priorities
Our analysis suggests the following prioritized actions for OT asset owners:
- Inventory and Identification: Identify all server hardware in the production environment utilizing AMI MegaRAC SPx firmware. This requires reviewing hardware specifications or consulting with server OEMs, as the BMC firmware is often abstracted from the primary OS.
- Network Isolation: Ensure that BMC management interfaces are restricted to a dedicated, isolated management VLAN. Access should be limited to authorized administrative workstations via strict firewall rules to prevent remote spoofing attempts from general OT or IT networks.
- Vendor Patching: Apply firmware updates provided by the hardware OEM. Because this is a third-party component integrated into various products, users must obtain the specific update validated for their server model rather than applying generic firmware.
- Disable Unused Interfaces: If the Redfish Host Interface is not required for operational maintenance, evaluate whether it can be disabled to reduce the attack surface.
How to validate remediation
Validation should be conducted according to OEM guidance and within established change control windows to avoid unplanned downtime.
- Version Verification: Confirm that the installed BMC firmware version matches the patched version specified by the vendor. Note that a version check alone does not guarantee security but confirms the application of the fix.
- Access Control Audit: Verify through firewall logs and configuration audits that the Redfish interface is unreachable from non-authorized network segments.
Limits and open questions
It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns. Additionally, because MegaRAC SPx is a component used by many different vendors, the availability of patches may vary by OEM. Users should be aware that applying firmware updates to BMCs carries inherent risks to hardware availability; therefore, all updates should be preceded by a verified backup of configurations and a documented rollback plan.
Source and editorial note
CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability · Source date: June 25, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: June 28, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 16, 2026 at 01:31 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗