CVE-2024-12054

CVE Enrichment

CVSS: 5.9 MEDIUM
EPSS: 0.24%
EPSS Percentile: 13.90%
CISA KEV: Not listed

Description

ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 14-Feb-2025 06:15
Last Modified: 17-Jun-2026 13:58
EPSS Date: 2026-10-20
CWE: CWE-305

CVSS Vector


            CVSS:4.0                            AV:A /
                            AC:H /
                            AT:P /
                            PR:N /
                            UI:P /
                            VC:N /
                            VI:L /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 21-Oct-2026 20:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

by a global automotive supplier. Tracked as CVE-2024-12054, the issue affected Upstream’s 2026 Automotive Cybersecurity Report Finds Ransomware Incidents Doubled in 2025

CVE (6)

People (1)

MITRE ATT&CK (6)

Vendors (1)

Products (2)

Tools (3)

Industries (6)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.