Security researchers have discovered a new critical vulnerability in AMI’s MegaRAC software that enables attackers to bypass authentication remotely. Their investigation revealed the flaw exists in the host-interface-support-module.lua file within the firmware filesystem, allowing attackers to manipulate HTTP header values to circumvent security controls. Successful exploitation could allow attackers to gain complete remote control of compromised servers, deploy malware or ransomware, tamper with firmware, physically damage hardware through over-voltage conditions, or create indefinite reboot loops that victims cannot recover from without re-provisioning. The vulnerability exists in the Redfish interface of AMI’s Baseboard Management Controller (BMC) software and impacts various devices including HPE Cray XD670 and Asus RS720A-E11-RS24U servers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The code uses a regex expression that extracts everything up to the first colon, meaning if an attacker sends “169.254.0.17:” as input, the system extracts “169.254.0.17” which matches database values and bypasses authentication. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This latest security flaw, identified as CVE-2024-54085, affects numerous data center equipment and server models, potentially compromising cloud infrastructure security across many organizations worldwide. The severity of this vulnerability cannot be overstated, with CVSS scores of 10.0 (CVSSv3) and 10.0 (CVSSv4) when Redfish is directly exposed to the internet. Eclypsium researchers identified that versions of MegaRAC as recent as August 2024 are affected by this authentication bypass vulnerability. Organizations are advised to ensure remote management interfaces are not exposed externally and to perform regular firmware updates on all servers. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. According to security analyses, approximately 1,000 exposed instances were discovered on the public internet through Shodan searches.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Mar 2025 15:16:14 +0000