CVE-2024-12054 - CVE House
Back to Database
Status published Medium CVE-2024-12054

ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness

Vulnerability Description

ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12054

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • National Motor Freight Traffic Association, Inc. (NMFTA) researchers Ben Gardiner and Anne Zachos reported this vulnerability to CISA.

References

Affected Vendor

Affected Software

RSSPlus 2M
Vulnerable Versions:
01/08

Timeline

Official Publish: February 13th, 2025
Last Modified: February 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-305

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.