Authentication Bypass in AMI MegaRAC SPx (CVE‑2024‑54085) Threatens Server Management Interfaces
What It Is — AMI MegaRAC SPx’s Redfish host interface contains an authentication‑bypass flaw that can be triggered by spoofing the management server’s identity. Successful exploitation grants an attacker unauthorized access to the out‑of‑band management console.
Exploitability — Listed in CISA’s Known Exploited Vulnerabilities (KEV) program; proof‑of‑concept code is publicly available. CVSS v3.1 base score 8.8 (High). No vendor patch was available at the time of disclosure.
Affected Products — AMI MegaRAC SPx firmware versions prior to the vendor‑released fix (see AMI advisory for exact version numbers).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for robust identity and access management over privileged hardware interfaces—a core control objective that underpins many compliance frameworks.
- Highlights gaps in continuous monitoring and logging of out‑of‑band management activity, which auditors expect as evidence of due diligence.
- Shows why enterprises must maintain defensible audit trails for any privileged access, especially when third‑party firmware is involved.
Recommended Actions
- Apply AMI’s firmware patch immediately; verify the installed version.
- Enforce network segmentation for Redfish endpoints and restrict access to authorized admin subnets.
- Enable multi‑factor authentication or certificate‑based authentication for the management console where supported.
- Deploy continuous monitoring of Redfish API calls and integrate alerts into your SIEM.
- Document remediation steps as evidence for audit readiness.
Source: CISA KEV – CVE‑2024‑54085