CVE-2024-54085: ami megarac sp-x +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-54085

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 60,7%

Kerentanan Authentication Bypass by Spoofing pada ami megarac sp-x, netapp h300s firmware +8 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Juni 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Rincian

Terbit di NVD: 11 Maret 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-290: Authentication Bypass by Spoofing
EPSS (30 hari): 60,7% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
Masuk KEV: 25 Juni 2025
Tenggat CISA: 16 Juli 2025 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ami	megarac sp-x	Versi 12 hingga sebelum 12.7
ami	megarac sp-x	Versi 13 hingga sebelum 13.5
netapp	h300s firmware	Semua versi
netapp	h500s firmware	Semua versi
netapp	h700s firmware	Semua versi
netapp	h410s firmware	Semua versi
netapp	h410c firmware	Semua versi
netapp	sg6160 firmware	Semua versi
netapp	sgf6112 firmware	Semua versi
netapp	sg110 firmware	Semua versi
netapp	sg1100 firmware	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf advisory vendor
https://nvd.nist.gov/vuln/detail/CVE-2024-54085 pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-54085 pemerintah AS
https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-serv... press/media coverage · advisory pihak ketiga
https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/ press/media coverage · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20250328-0003/ advisory pihak ketiga
https://www.bleepingcomputer.com/news/security/cisa-ami-megarac-bug-that-lets-hackers-brick-servers-now-active... press/media coverage · advisory pihak ketiga
https://www.networkworld.com/article/4013368/ami-megarac-authentication-bypass-flaw-is-being-exploitated-cisa-... press/media coverage · advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.