As clock ticks, vendors slowly patch critical flaw in AMI MegaRAC BMC firmware

Dell, on the other hand, has confirmed that its systems are unaffected by the MegaRAC issue, since it uses its own Integrated Dell Remote Access Controller (iDRAC) in its servers.

How could attackers exploit the flaw?

A week after the patch was posted by AMI in March, Eclypsium, the company that discovered the vulnerability in late 2024, published more details of its inner workings:

“To our knowledge, the vulnerability only affects AMI’s BMC software stack. However, since AMI is at the top of the BIOS supply chain, the downstream impact affects over a dozen manufacturers,” wrote Eclypsium researchers.

The flaw, scored at the maximum severity of 10, is designated a ‘critical’ flaw on CVSS. It would allow bypass authentication through the Redfish interface, according to Eclypsium, with a range of outcomes, including remote control of the server, deployment of malware/ransomware, and destructive actions such as unstoppable reboot loops and even bricked motherboards.

In short, it would not be a good day for victims, although no exploitation of the vulnerability has so far been detected. But as with any software vulnerability, what counts is the speed and ease with which it is patched.

The first issue illustrated by the apparently slow response to CVE-2024-54085 is the complexity of the patching process when the software involved is part of a supply chain involving more than one vendor.