Home / Security / Advisories / NTAP-20250328-0003

NTAP-20250328-0003 — CVE-2024-54085 AMI MegaRAC Vulnerability in NetApp Products

Published 2025-03-28 · Updated 2025-07-30 · Status: Final · Exploitation: Public · Severity: not scored · ONTAP affected: No — other NetApp product

Official advisory: NTAP-20250328-0003 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: SolidFire / NetApp HCI · StorageGRID | other NetApp product

CVEs in this advisory

CVE-2024-54085 · site index

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). StorageGRID Baseboard Management Controller (BMC) - SG6160/SGF6112/SG110/SG1100: These BMCs are tracked as affected. StorageGRID Baseboard Management Controller (BMC) - SG6060/SGF6024/SG100/SG1000: These BMCs are tracked as not affected due to non-vulnerable BMC firmware versions.

Affected products

NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
NetApp HCI Baseboard Management Controller (BMC) - H410C
StorageGRID Baseboard Management Controller (BMC) - SG6160/SGF6112/SG110/SG1100

Official fixes

StorageGRID Baseboard Management Controller (BMC) - SG6160/SGF6112/SG110/SG1100 — vendor fix ↗

References

https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf ↗

What to do

Compare your installed product and version against the affected list above and the official advisory's affected-versions table.
Apply the fixed release named in the official advisory, or the documented workaround if no fix ships yet.
Limit management-plane exposure (BMC/management interfaces, web UIs, SNMP) until patched.
Track follow-ups in the site CVE index and the security RSS feed.