CVE Feed

    Dashboard / CVE / CVE-2024-54085

    CVE-2024-54085

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

    Published:Mar 11, 2025
    Last Modified:Feb 26, 2026
    EPS:Mar 11, 2025
    EPSS Score:0.08241
    CVSS Score:9.8

    CISA Notification

    Description

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Jul 16, 2025
    422 days ago
    Alert Date
    Jun 25, 2025
    443 days ago

    Affected Products

    Vendor
    Ami
    Product
    Megarac Sp-x
    Vendor
    Netapp
    Product
    H300s
    Vendor
    Netapp
    Product
    H300s Firmware
    Vendor
    Netapp
    Product
    H410c
    Vendor
    Netapp
    Product
    H410c Firmware
    Vendor
    Netapp
    Product
    H410s
    Vendor
    Netapp
    Product
    H410s Firmware
    Vendor
    Netapp
    Product
    H500s
    Vendor
    Netapp
    Product
    H500s Firmware
    Vendor
    Netapp
    Product
    H700s
    Vendor
    Netapp
    Product
    H700s Firmware
    Vendor
    Netapp
    Product
    Sg110
    Vendor
    Netapp
    Product
    Sg1100
    Vendor
    Netapp
    Product
    Sg1100 Firmware
    Vendor
    Netapp
    Product
    Sg110 Firmware
    Vendor
    Netapp
    Product
    Sg6160
    Vendor
    Netapp
    Product
    Sg6160 Firmware
    Vendor
    Netapp
    Product
    Sgf6112
    Vendor
    Netapp
    Product
    Sgf6112 Firmware

    Exploits

    https://github.com/Mr-Zapi/CVE-2024-54085

    Related CVEs

    CVE-2023-37297 (CVSS 8.3) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adj…
    CVE-2023-37296 (CVSS 8.3) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an …
    CVE-2023-37295 (CVSS 8.3) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an…
    CVE-2023-37294 (CVSS 8.3) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via …
    CVE-2023-37293 (CVSS 9.6) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an…
    CVE-2023-34333 (CVSS 7.8) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to d…
    CVE-2023-3043 (CVSS 9.6) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overfl…
    CVE-2023-34332 (CVSS 7.8) — AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to d…
    CVE-2023-34330 (CVSS 8.2) — AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic…
    CVE-2023-34329 (CVSS 9.1) — AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High