A ticking time bomb sits inside millions of servers worldwide. Security researchers at Eclypsium just uncovered a critical vulnerability in AMI’s MegaRAC Baseboard Management Controller software. The flaw, tracked as CVE-2024-54085, lets hackers completely bypass authentication and gain superuser access to affected systems. No password needed. Just point, click, own.
This isn’t some minor glitch. We’re talking about the potential for total server hijacking, malware deployment, and yes, even bricking devices beyond repair. Great news for your average cybercriminal, terrible news for everyone else.
The vulnerability impacts hardware from major vendors including HPE, Asus, Asrock, and Lenovo. But that’s just the confirmed list. AMD, Dell EMC, Gigabyte, Nvidia, and Qualcomm devices could all be affected too. Over 1,000 internet-exposed instances are already sitting there like ducks on a pond, waiting to be compromised.
What’s particularly terrifying? Attackers can create indefinite reboot loops that operators can’t recover from. They can implant malicious firmware that persists across reboots. They can even cause physical damage through overvolting attacks. Fun times ahead for data centers everywhere.
The impact potential is massive. One successful attack could disrupt entire cloud providers. Customer data, critical applications, infrastructure services – all at risk from a single vulnerability.
And let’s be honest, the patch situation isn’t great either. While AMI released fixes on March 11, 2025, those patches still need to be incorporated into vendor-specific firmware updates. Lenovo and HPE have issued advisories, but many systems remain vulnerable.
CISA has released security guidelines, but really, who reads those? The whole situation highlights the stunning fragility of our digital infrastructure. One small flaw in a component most people have never heard of, and suddenly millions of servers are at risk. This underscores why vulnerability management is essential for survival in today’s digital landscape. Security experts recommend restricting BMC interface access to administrative users only as a key mitigation strategy.
Cloud computing, meet your Achilles heel.
