CVE-2024-54085 is a critical security vulnerability identified in AMI's MegaRAC-SPx BMC firmware versions 12.0 and 13.0. The vulnerability is classified as an authentication bypass by spoofing (CWE-290) and affects the Redfish Host Interface, a standard management API used for out-of-band server management. An attacker can exploit this flaw remotely without any authentication, privileges, or user interaction, effectively bypassing all authentication controls. This allows the attacker to gain unauthorized access to the BMC, which controls critical server management functions such as power cycling, firmware updates, and hardware monitoring. The CVSS 4.0 score of 10 reflects the vulnerability's extreme severity, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability could lead to full system compromise, data theft, or disruption of services. Although no public exploits have been reported yet, the ease of exploitation and critical impact make this a high-priority threat. The affected MegaRAC-SPx firmware is commonly used in enterprise servers and data center hardware, making this a significant risk for organizations relying on these platforms. The lack of available patches at the time of disclosure necessitates immediate mitigation steps to reduce exposure.

For European organizations, the impact of CVE-2024-54085 is substantial. The vulnerability enables attackers to remotely bypass authentication on BMCs, potentially gaining full control over server hardware management. This can lead to unauthorized data access, manipulation, or destruction, disruption of critical IT infrastructure, and potential lateral movement within networks. Sectors such as finance, telecommunications, government, and cloud service providers are particularly vulnerable due to their reliance on robust server management and high-value data. The loss of confidentiality could expose sensitive personal and corporate data, violating GDPR and other regulatory requirements. Integrity compromise could allow attackers to alter system configurations or firmware, leading to persistent backdoors or sabotage. Availability impacts could result in denial of service by shutting down or rebooting servers unexpectedly, affecting business continuity. Given the critical nature of BMCs in managing hardware, exploitation could also impact physical security controls and recovery mechanisms. The threat is heightened by the lack of authentication and user interaction requirements, making remote exploitation feasible for a wide range of attackers.

1. Immediately restrict network access to the Redfish Host Interface by implementing strict firewall rules and network segmentation, limiting access only to trusted management networks. 2. Monitor network traffic and logs for unusual or unauthorized access attempts to the BMC and Redfish interface. 3. Disable the Redfish interface if it is not required for operational purposes until a patch is available. 4. Engage with AMI and server vendors to obtain and apply firmware updates or patches as soon as they are released. 5. Implement multi-factor authentication and strong access controls on management interfaces where possible, even if the vulnerability bypasses authentication, to add layers of defense. 6. Conduct regular security audits and vulnerability assessments on BMC firmware and management interfaces. 7. Prepare incident response plans specifically addressing BMC compromise scenarios to enable rapid containment and recovery. 8. Consider deploying network intrusion detection/prevention systems (IDS/IPS) tuned to detect anomalous Redfish API calls or BMC-related attacks. 9. Educate IT and security teams about the risks associated with BMC vulnerabilities and the importance of timely patching and monitoring.