As clock ticks, vendors slowly patch critical flaw in AMI MegaRAC BMC firmware

Weeks after BIOS developer AMI released an update fixing a critical vulnerability in its MegaRAC baseband management controller (BMC) firmware used in many enterprise servers and storage systems, OEM patches addressing the issue are slowly trickling out.

A BMC is an embedded chip that allows IT teams to monitor, troubleshoot, and control servers remotely via the industry standard Redfish interface, even when they are turned off or the OS is unresponsive. This makes exploits particularly dangerous.

A patch for the latest vulnerability, Identified as CVE-2024-54085, was released by AMI on March 11. However, its fix was only the beginning of the story; numerous OEMs still had to process the update for their individual server products.

Unfortunately, this has taken time, increasing the risk that an attacker will exploit the issue.