CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-06-25. EPSS: 60.7% chance of exploitation in the next 30 days.

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Affected products

• AMI MegaRAC SPx: from 12, before 12.7 (fixed in 12.7); from 13, before 13.5 (fixed in 13.5)
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp SG1100 Firmware: affected versions not specified
• Netapp SG110 Firmware: affected versions not specified
• Netapp SG6160 Firmware: affected versions not specified
• Netapp SGF6112 Firmware: affected versions not specified

Published 2025-03-11. Last modified 2026-06-17.