CVE-2022-40242 is a critical default credentials vulnerability affecting AMI MegaRAC SP-X firmware, used in servers from major vendors like AMD, ARM, HPE, and Dell. With a CVSS score of 9.8, this easily exploitable network-based flaw allows unauthenticated attackers to gain full control over affected servers, leading to complete compromise, data theft, or even bricking of devices. While there is no public exploit code or evidence of active exploitation, the vulnerability has garnered significant community discussion and media attention due to its widespread impact and severe consequences.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12CPE matchmatch criteria | cpe:2.3:o:ami:megarac_sp-x:12:*:*:*:*:*:*:* | ||
13CPE matchmatch criteria | cpe:2.3:o:ami:megarac_sp-x:13:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.