Horizon Alert
Summary of the vulnerability and why it matters
AMI's MegaRAC SPx management software, used in various server environments, contains a vulnerability that could allow unauthorized access. This flaw can be exploited remotely, potentially impacting the confidentiality, integrity, and availability of affected systems and data. The vulnerability is present in the Redfish Host Interface component of the Baseboard Management Controller (BMC).
- Vulnerable management interface
- Remote authentication bypass
- System compromise and data loss
Attack Path
How an attacker could exploit the issue
This vulnerability allows attackers to bypass authentication on a server's Baseboard Management Controller (BMC) through its Redfish Host Interface. Successful exploitation could result in unauthorized access, leading to potential loss of data confidentiality, integrity, and availability for affected organizations. The attack requires the BMC's Redfish interface to be exposed externally.
- External network exposure of BMC Redfish interface.
- Attacker remotely accesses the interface.
- Bypasses authentication, gains control.
Live Threat
Current exploitation, exposure, and threat context
This critical vulnerability allows attackers to bypass authentication on server management interfaces, granting them extensive control over affected systems. Attackers could remotely control servers, deploy malware, tamper with firmware, or even cause physical damage to hardware. The widespread use of this firmware in various server models means a significant number of organizations could be impacted. Given that this vulnerability is actively being exploited and has been added to CISA's Known Exploited Vulnerabilities catalog, it should be treated with the highest urgency.
- Likely attacker skill level: Any skill level.
- Required access or conditions: Remote network access.
- Business risk or urgency: Critical and immediate.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
AMI's SPx software contains a critical vulnerability that allows remote attackers to bypass authentication through the Redfish Host Interface. Successful exploitation of this vulnerability could result in unauthorized access leading to loss of confidentiality, integrity, and availability of affected systems. Organizations should prioritize addressing this vulnerability to mitigate potential business risks.
- Identify all systems running affected AMI SPx versions.
- Restrict network access to the Redfish Host Interface.
- Apply vendor-provided updates and validate system remediation.
- Monitor for unusual system activity.
