CVE-2024-54085
CVE-2024-54085 is a critical authentication bypass vulnerability in AMI’s SPx, specifically within the BMC (Baseboard Management Controller). This Redfish Host Interface vulnerability allows remote attackers to bypass authentication. A successful exploit can result in a loss of confidentiality, integrity, and/or availability of the affected system. Despite a CVSS score of 0, SOCRadar's Vulnerability Risk Score (SVRS) indicates a score of 40, highlighting a moderate level of risk. This suggests potential real-world exploitability and the necessity for monitoring. The vulnerability is associated with CWE-290 (Authentication Bypass) which is a common attack vector. Although the SVRS is not in the critical range, the potential for compromise and the presence of "In The Wild" tags indicate that organizations should assess and monitor this CVE promptly.
Description
CVE-2024-54085 describes a vulnerability in AMI’s SPx, specifically within the Baseboard Management Controller (BMC). This flaw allows a remote attacker to bypass authentication via the Redfish Host Interface. Successful exploitation can result in a loss of confidentiality, integrity, and/or availability of the system. The SOCRadar Vulnerability Risk Score (SVRS) is 48, indicating a moderate level of risk, although not critical (above 80), it still necessitates attention. The CVE is tagged "In The Wild," indicating that the vulnerability is actively exploited by hackers.
Key Insights
- Authentication Bypass: The core issue is the ability to bypass authentication, granting unauthorized access to the BMC. This access can then be leveraged to perform malicious activities.
- Remote Exploitation: The vulnerability is remotely exploitable through the Redfish interface, meaning attackers do not require physical access to the server.
- Impact on CIA Triad: Exploitation can compromise all three pillars of security: confidentiality, integrity, and availability, potentially leading to data breaches, system corruption, and service disruption.
- "In The Wild" Exploitation: The tag indicates the vulnerability is actively exploited by hackers, meaning that there is an elevated risk associated with the CVE.
Mitigation Strategies
- Patch and Update: Apply the latest patches and updates provided by AMI for the SPx BMC firmware as soon as they become available. This is the most effective way to address the vulnerability.
- Network Segmentation: Isolate the BMC network from the rest of the corporate network. This limits the blast radius if the BMC is compromised.
- Redfish Interface Security: Implement strict access controls and strong authentication mechanisms for the Redfish interface. Consider disabling the interface if it is not actively used.
- Monitor BMC Activity: Implement robust monitoring and logging of BMC activity to detect suspicious behavior indicative of exploitation attempts.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.