PT-2023-24816 · Ami · Ami Megarac Sp-X

Vlad Babkin · Published 2023-07-18 · Updated 2025-10-02 · CVE-2023-34329

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMI MegaRAC SPx12 (affected versions not specified)

Description The issue allows a user to bypass authentication by spoofing the HTTP header, potentially leading to loss of confidentiality, integrity, and availability. This is achieved by exploiting a vulnerability in the BMC of the affected system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-306

CWE-290

Related Identifiers

CVE-2023-34329

Affected Products

Ami Megarac Sp-X

References · 12

• https://osv.dev/vulnerability/CVE-2023-34329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34329 · Security Note
• https://security.netapp.com/advisory/ntap-20230814-0004 · Note
• https://twitter.com/securityweekly/status/1940511513753657837 · Twitter Post
• https://t.me/cvenotify/54681 · Telegram Post
• https://t.me/cvenotify/56442 · Telegram Post
• https://t.me/cibsecurity/66950 · Telegram Post
• https://t.me/echeloneyes/1770 · Telegram Post
• https://t.me/true_secator/4644 · Telegram Post
• https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023006.pdf · Note
• https://t.me/secharvester/20256 · Telegram Post
• https://t.me/true_secator/6854 · Telegram Post