ACTIVELY EXPLOITED
CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
| Vendor | AMI |
|---|---|
| Product | MegaRAC SPx |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Jun 2025 |
| CISA federal deadline | 16 Jul 2025 |
| Weakness (CWE) | CWE-290 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.