AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

10.47 %

Predictive Probability

Percentile Rank

93.1 th

Documented as more likely to be exploited than 93.1% of known CVEs.

Detection Date

Jun 25, 2025

Remediation Due

Jul 16, 2025

CISA Catalog Active

Threat Analysis

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

AMI

Affected Product

MegaRAC SPx

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-290

External Intelligence

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see:

https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf

https://security.netapp.com/advisory/ntap-20250328-0003/

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-54085