{"id":"CVE-2024-12054","aliases":["EUVD-2024-50560","GHSA-gfp3-9j64-8w7j"],"status":"published","title":"ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness","description":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00238,"percentile":0.14952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-305"],"published":"2025-02-13T22:08:03Z","modified":"2026-06-17T06:58:57Z","products":[{"vendor":"zf","product":"rssplus 2m"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"},{"url":"https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12054"},{"url":"https://github.com/advisories/GHSA-gfp3-9j64-8w7j"}],"sources":{"cve":[{"id":"CVE-2024-12054","title":"ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness","description":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.","status":"published","published":"2025-02-13T22:08:03.541Z","modified":"2025-02-14T15:58:47.771Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-50560","description":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.","status":"published","published":"2025-02-13T22:08:03Z","modified":"2025-02-14T15:58:47Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:30.772675Z"}],"ghsa":[{"id":"GHSA-gfp3-9j64-8w7j","title":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability...","description":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.","status":"published","published":"2025-02-14T00:30:44Z","modified":"2025-02-14T00:30:55Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:59:56.485496Z"}],"nvd":[{"id":"CVE-2024-12054","description":"ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.","status":"published","published":"2025-02-13T23:15:09.823Z","modified":"2026-06-17T06:58:57.657Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:10:44.508862Z"}]}}