CVE-2024-54085
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 (Critical). KEV-listed — actively exploited. EPSS 8.2%. BMC-level access enables persistent, OS-independent compromise. Affects servers from multiple OEMs using AMI firmware. No authentication required for exploitation. |
| Exploit ScenarioDerived | An attacker with network access to the BMC management interface sends crafted Redfish API requests that bypass authentication, gaining administrative BMC access. From this position, the attacker can: read/write server firmware, access the virtual console (KVM), mount virtual media to inject malicious bootloaders, modify BIOS settings, or power cycle the server — all invisible to OS-level security monitoring. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
A critical authentication bypass in AMI SPx BMC firmware allows unauthenticated remote attackers to gain full control of server hardware through the Redfish Host Interface. This KEV-listed vulnerability (CVSS 9.8) threatens the entire server fleet of organizations using AMI-based BMC implementations, enabling attackers to persist below the OS layer where traditional security tools cannot detect them.
Earlier versions of this analysis (1)
AMI SPx BMC contains an authentication spoofing vulnerability (CWE-290) in the Redfish Host Interface that allows remote attackers to bypass authentication entirely, gaining administrative access to BMC functions including power management, firmware updates, and console access.
RemediationAI
Apply AMI firmware update immediately. Isolate BMC management interfaces on dedicated management VLANs with strict access controls. Disable Redfish Host Interface if not required. Implement network segmentation to prevent unauthorized access to BMC ports (typically 443, 80, 623).
Affected ProductsAI
AMI SPx BMC firmware (multiple OEM server platforms)
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Redfish Host Interface in AMI SPx BMC does not properly validate authentication tokens, allowing attackers to spoof credentials and authenticate as administrative users. BMC (Baseboard Management Controller) operates at the hardware level, independent of the operating system, making this particularly dangerous — compromised BMCs persist across OS reinstalls and can manipulate hardware, intercept data, and maintain covert access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Executive ViewAI
Organizations using the BMC where an Attacker may bypass authentication remotely face critical risk from CVE-2024-54085 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB