🚨Yesterday marked a notable moment as CISA added, for the first time, an AMI MegaRAC BMC vulnerability (CVE-2024-54085) to its Known Exploited Vulnerabilities (KEV) Catalog. Baseboard Management Controllers (BMCs) have long been attractive targets for attackers, yet unfortunately, security practices surrounding these critical components have evolved little over the years. Vulnerabilities like CVE-2024-54085 remain widespread and alarmingly easy to exploit, echoing the early days of application security in the 90s when secure development lifecycle practices were virtually non-existent. Additionally, the choice of Lua as a scripting language raises concerns, as it lacks robust support from mainstream security tools, creating significant blind spots. AMI MegaRAC BMC technology underpins critical infrastructure used by numerous enterprise vendors, forming the backbone of today's data center and cloud computing environments. CVE-2024-54085 is impacting the entire ecosystem rather than just a single vendor. The @Binarly_io team has consistently highlighted these hidden dangers within BMC security, urging the industry multiple times: ✸ CVE-2024-36435 Deep-Dive: The Year’s Most Critical BMC Security Flaw binarly.io/blog/cve-2024-364… ✸ Old But Gold: The Underestimated Potency of Decades-Old Attacks on BMC Security binarly.io/blog/old-but-gold… ✸ Binarly REsearch Uncovers Major Vulnerabilities in Supermicro BMCs binarly.io/blog/binarly-rese…