Vulnerability-Lookup

GHSA-GFP3-9J64-8W7J

Vulnerability from github – Published: 2025-02-14 00:30 – Updated: 2025-02-14 00:30

Details

ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

5.9 (Medium)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-12054"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T23:15:09Z",
    "severity": "MODERATE"
  },
  "details": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.",
  "id": "GHSA-gfp3-9j64-8w7j",
  "modified": "2025-02-14T00:30:44Z",
  "published": "2025-02-14T00:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12054"
    },
    {
      "type": "WEB",
      "url": "https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-12054 (GCVE-0-2024-12054)

Vulnerability from cvelistv5 – Published: 2025-02-13 22:08 – Updated: 2025-02-14 15:58

Title

ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

5.9 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-14 15:58 UTC

CWE

CWE-305

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 352 records in the last 180 days details

References

2 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://nmfta.org/wp-content/media/2022/11/Action…

Impacted products

1 product

Vendor	Product	Version
ZF	RSSPlus 2M	Affected: 01/08 , < 01/23 (custom)

Credits

National Motor Freight Traffic Association, Inc. (NMFTA) researchers Ben Gardiner and Anne Zachos reported this vulnerability to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12054",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T15:58:36.827378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T15:58:47.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RSSPlus 2M",
          "vendor": "ZF",
          "versions": [
            {
              "lessThan": "01/23",
              "status": "affected",
              "version": "01/08",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "National Motor Freight Traffic Association, Inc. (NMFTA) researchers Ben Gardiner and Anne Zachos reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.\n\n\u003cbr\u003e"
            }
          ],
          "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "CWE-305",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-13T22:08:03.541Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"
        },
        {
          "url": "https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"
        }
      ],
      "source": {
        "advisory": "ICSA-25-021-03",
        "discovery": "EXTERNAL"
      },
      "title": "ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages.\n\n\u003cbr\u003e"
            }
          ],
          "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eZF recommends:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMoving away from security access and implementing the latest security feature authenticate (0x29).\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eEnsure random numbers are generated from a cryptographically secure hardware true random number generator.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eAdopting modern standards/protocols for truck trailer communication.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "ZF recommends:\n\n\n\n  *  Moving away from security access and implementing the latest security feature authenticate (0x29).\u00a0 \n\n\n  *  Ensure random numbers are generated from a cryptographically secure hardware true random number generator.\u00a0 \n\n\n  *  Adopting modern standards/protocols for truck trailer communication."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNMFTA has published detailed information about how to mitigate these issues in the following ways:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eInstall a LAMP ON firewall for each ECU.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eUse a LAMP detect circuit LAMP ON sender with each trailer.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eChange addresses dynamically on each tractor in response to detecting a transmitter on its current address.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eInstall RF chokes on each trailer between chassis ground and wiring ground.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eLoad with LAMP keyhole signal on each tractor.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003cli\u003eFlood with jamming signal on each tractor.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ePlease visit \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf\"\u003eNMFTA\u003c/a\u003e\u003c/p\u003e for additional details on these and other solutions.\n\n\u003cbr\u003e"
            }
          ],
          "value": "NMFTA has published detailed information about how to mitigate these issues in the following ways:\n\n\n\n  *  Install a LAMP ON firewall for each ECU.\u00a0 \n\n\n  *  Use a LAMP detect circuit LAMP ON sender with each trailer.\u00a0 \n\n\n  *  Change addresses dynamically on each tractor in response to detecting a transmitter on its current address.\u00a0 \n\n\n  *  Install RF chokes on each trailer between chassis ground and wiring ground.\u00a0 \n\n\n  *  Load with LAMP keyhole signal on each tractor.\u00a0 \n\n\n  *  Flood with jamming signal on each tractor.\u00a0 \n\n\n\n\n\nPlease visit  NMFTA https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf \n\n for additional details on these and other solutions."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2024-12054",
    "datePublished": "2025-02-13T22:08:03.541Z",
    "dateReserved": "2024-12-02T19:56:35.074Z",
    "dateUpdated": "2025-02-14T15:58:47.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted