CVE-2024-54085 (CVSS 10.0) : A critical vulnerability affecting the American Megatrends Inc. (AMI) MegaRAC SPx firmware package for baseboard management controllers (BMCs).
Attackers can bypass authentication in the Redfish Host Interface by modifying the X-Server-Addr or Host header in HTTP requests, tricking the BMC into believing requests originate from the host system itself.
**Exploitation does not require authentication.**
2025. 07. 03.
