CVEブラウザに戻る

CVE-2024-54085

🔥 Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-03-11

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Affected Platforms (CPE)

💻

Ami

Megarac Sp X

>= 12 and < 12.7>= 13 and < 13.5

💻

Netapp

H300s Firmware

All versions

💻

Netapp

H500s Firmware

All versions

💻

Netapp

H700s Firmware

All versions

References & Advisories

🔗 https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf

🔗 https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/

🔗 https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/

🔗 https://security.netapp.com/advisory/ntap-20250328-0003/

🔗 https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-actively-exploited/

🔗 https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-warns.html

🔗 https://nvd.nist.gov/vuln/detail/CVE-2024-54085

🔗 https://security.netapp.com/advisory/ntap-20250328-0003/

関連するセキュリティ記事

グローバル・サイバーインテリジェンス・ダイジェスト：2026年7月24日

本号では、Check Point CVE-2026-16232 SmartConsole 認証回避の悪用状況、ロシア背景の LAUNDRY BEAR による Zimbra 脆弱性攻撃、偽 Claude Desktop 悪意広告キャンペーン、および Chaos ランサムウェアの最新動向を分析します。

関連する脆弱性情報

CVE-2023-343299.1

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A s...

CVE-2023-255057.8

NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate leve...

CVE-2023-288639.1

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.

CVE-2023-251925.3

AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.

CVE-2024-54085 Detail & Impact Analysis | CVSS 10.0 (CRITICAL) | Cyber-Sec.Space | Cyber-Sec.Space