CVE-2024-12054
Last modified
CVE-2024-12054 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-12054?
How severe is CVE-2024-12054?
How do I fix CVE-2024-12054?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-12046The Medical Addon for Elementor plugin for WordPress is vuln…4.3
- CVE-2024-12047The WP Compress – Instant Performance & Speed Optimization p…6.1
- CVE-2024-12048An IDOR (Insecure Direct Object Reference) vulnerability exi…8.8
- CVE-2024-12049The Woo Ukrposhta plugin for WordPress is vulnerable to Refl…6.1
- CVE-2024-1205The Management App for WooCommerce – Order notifications, Or…8.8
- CVE-2024-12053Type Confusion in V8 in Google Chrome prior to 131.0.6778.10…8.8
- CVE-2024-12055A vulnerability in Ollama versions <=0.3.14 allows a malicio…7.5
- CVE-2024-12056The Client secret is not checked when using the OAuth Passwo…2.3
- CVE-2024-12057User credentials (login & password) are inserted into log fi…1.8
- CVE-2024-12058External control of a file name in Ivanti Connect Secure bef…4.9
- CVE-2024-12059The ElementInvader Addons for Elementor plugin for WordPress…4.3
- CVE-2024-1206The WP Recipe Maker plugin for WordPress is vulnerable to SQ…8.8
Are you affected by CVE-2024-12054?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST