{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-12054", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-12-02T19:56:35.074Z", "datePublished": "2025-02-13T22:08:03.541Z", "dateUpdated": "2025-02-14T15:58:47.771Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "RSSPlus 2M", "vendor": "ZF", "versions": [{"lessThan": "01/23", "status": "affected", "version": "01/08", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "National Motor Freight Traffic Association, Inc. (NMFTA) researchers Ben Gardiner and Anne Zachos reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.\n\n<br>"}], "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 5.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "description": "CWE-305", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-02-13T22:08:03.541Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"}, {"url": "https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"}], "source": {"advisory": "ICSA-25-021-03", "discovery": "EXTERNAL"}, "title": "ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages.\n\n<br>"}], "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages."}, {"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>ZF recommends:</p>\n<ul>\n<li>Moving away from security access and implementing the latest security feature authenticate (0x29).&nbsp; <br></li>\n<li>Ensure random numbers are generated from a cryptographically secure hardware true random number generator.&nbsp; <br></li>\n<li>Adopting modern standards/protocols for truck trailer communication.&nbsp; <br></li>\n</ul>\n\n<br>"}], "value": "ZF recommends:\n\n\n\n * Moving away from security access and implementing the latest security feature authenticate (0x29).\u00a0 \n\n\n * Ensure random numbers are generated from a cryptographically secure hardware true random number generator.\u00a0 \n\n\n * Adopting modern standards/protocols for truck trailer communication."}, {"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>NMFTA has published detailed information about how to mitigate these issues in the following ways:</p>\n<ul>\n<li>Install a LAMP ON firewall for each ECU.&nbsp; <br></li>\n<li>Use a LAMP detect circuit LAMP ON sender with each trailer.&nbsp; <br></li>\n<li>Change addresses dynamically on each tractor in response to detecting a transmitter on its current address.&nbsp; <br></li>\n<li>Install RF chokes on each trailer between chassis ground and wiring ground.&nbsp; <br></li>\n<li>Load with LAMP keyhole signal on each tractor.&nbsp; <br></li>\n<li>Flood with jamming signal on each tractor.&nbsp; <br></li>\n</ul>\n<p>Please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf\">NMFTA</a></p> for additional details on these and other solutions.\n\n<br>"}], "value": "NMFTA has published detailed information about how to mitigate these issues in the following ways:\n\n\n\n * Install a LAMP ON firewall for each ECU.\u00a0 \n\n\n * Use a LAMP detect circuit LAMP ON sender with each trailer.\u00a0 \n\n\n * Change addresses dynamically on each tractor in response to detecting a transmitter on its current address.\u00a0 \n\n\n * Install RF chokes on each trailer between chassis ground and wiring ground.\u00a0 \n\n\n * Load with LAMP keyhole signal on each tractor.\u00a0 \n\n\n * Flood with jamming signal on each tractor.\u00a0 \n\n\n\n\n\nPlease visit NMFTA https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf \n\n for additional details on these and other solutions."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-14T15:58:36.827378Z", "id": "CVE-2024-12054", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T15:58:47.771Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-12054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-14T15:58:36.827378Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T15:58:43.141Z"}}], "cna": {"title": "ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness", "source": {"advisory": "ICSA-25-021-03", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "National Motor Freight Traffic Association, Inc. (NMFTA) researchers Ben Gardiner and Anne Zachos reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ZF", "product": "RSSPlus 2M", "versions": [{"status": "affected", "version": "01/08", "lessThan": "01/23", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"}, {"url": "https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"}], "workarounds": [{"lang": "en", "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages.", "supportingMedia": [{"type": "text/html", "value": "To most effectively mitigate general vulnerabilities of the powerline \ncommunication, any trucks, trailers, and tractors utilizing J2497 \ntechnology should disable all features where possible, except for \nbackwards-compatibility with LAMP ON detection only. Users acquiring new\n trailer equipment should migrate all diagnostics to newer trailer bus \ntechnology. Users acquiring new tractor equipment should remove support \nfor reception of any J2497 message other than LAMP messages.\n\n<br>", "base64": false}]}, {"lang": "en", "value": "ZF recommends:\n\n\n\n * Moving away from security access and implementing the latest security feature authenticate (0x29).\u00a0 \n\n\n * Ensure random numbers are generated from a cryptographically secure hardware true random number generator.\u00a0 \n\n\n * Adopting modern standards/protocols for truck trailer communication.", "supportingMedia": [{"type": "text/html", "value": "<p>ZF recommends:</p>\n<ul>\n<li>Moving away from security access and implementing the latest security feature authenticate (0x29).&nbsp; <br></li>\n<li>Ensure random numbers are generated from a cryptographically secure hardware true random number generator.&nbsp; <br></li>\n<li>Adopting modern standards/protocols for truck trailer communication.&nbsp; <br></li>\n</ul>\n\n<br>", "base64": false}]}, {"lang": "en", "value": "NMFTA has published detailed information about how to mitigate these issues in the following ways:\n\n\n\n * Install a LAMP ON firewall for each ECU.\u00a0 \n\n\n * Use a LAMP detect circuit LAMP ON sender with each trailer.\u00a0 \n\n\n * Change addresses dynamically on each tractor in response to detecting a transmitter on its current address.\u00a0 \n\n\n * Install RF chokes on each trailer between chassis ground and wiring ground.\u00a0 \n\n\n * Load with LAMP keyhole signal on each tractor.\u00a0 \n\n\n * Flood with jamming signal on each tractor.\u00a0 \n\n\n\n\n\nPlease visit NMFTA https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf \n\n for additional details on these and other solutions.", "supportingMedia": [{"type": "text/html", "value": "<p>NMFTA has published detailed information about how to mitigate these issues in the following ways:</p>\n<ul>\n<li>Install a LAMP ON firewall for each ECU.&nbsp; <br></li>\n<li>Use a LAMP detect circuit LAMP ON sender with each trailer.&nbsp; <br></li>\n<li>Change addresses dynamically on each tractor in response to detecting a transmitter on its current address.&nbsp; <br></li>\n<li>Install RF chokes on each trailer between chassis ground and wiring ground.&nbsp; <br></li>\n<li>Load with LAMP keyhole signal on each tractor.&nbsp; <br></li>\n<li>Flood with jamming signal on each tractor.&nbsp; <br></li>\n</ul>\n<p>Please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf\">NMFTA</a></p> for additional details on these and other solutions.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.", "supportingMedia": [{"type": "text/html", "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state.\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-02-13T22:08:03.541Z"}}}, "cveMetadata": {"cveId": "CVE-2024-12054", "state": "PUBLISHED", "dateUpdated": "2025-02-14T15:58:47.771Z", "dateReserved": "2024-12-02T19:56:35.074Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-02-13T22:08:03.541Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "ZF Roll Stability Support Plus (RSSPlus) \nis vulnerable to an authentication bypass vulnerability targeting \ndeterministic RSSPlus SecurityAccess service seeds, which may allow an \nattacker to remotely (proximal/adjacent with RF equipment or via pivot \nfrom J2497 telematics devices) call diagnostic functions intended for \nworkshop or repair scenarios. This can impact system availability, \npotentially degrading performance or erasing software, however the \nvehicle remains in a safe vehicle state."}], "id": "CVE-2024-12054", "lastModified": "2025-02-13T23:15:09.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "LOW"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2025-02-13T23:15:09.823", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}