EUVD-2026-54930
GHSA-p9pf-mc7w-9q4h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because exploitation requires high-privilege AWS credentials; limited C/I/A impact reflects scoped IAM boundary bypass, not full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.15.0 can resolve this issue. Upgrading the affected component is advised. The project explains: "The reported IAM permission configuration is a known historical issue that was already addressed in 2024, beginning with GoldVIP version 1.13.0. The permissions were updated in subsequent releases, including version 1.15.0. In addition, we also sent a request to either update or deprecate the older release in the AWS SAR application repository."
AnalysisAI
Improper IAM permission configuration in NXP GoldVIP's SitewiseCustomFunction Lambda Function Handler exposes AWS resources to remote attackers holding high-privilege credentials in the affected environment. The flaw, tracked as CWE-284, allows authorized high-privileged principals to exceed their intended access boundaries within the AWS deployment - a misconfigured IAM role rather than a missing authentication check. The vendor acknowledged this as a known historical issue resolved beginning with version 1.13.0 and fully addressed in 1.15.0; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
GoldVIP is an NXP Semiconductors automotive software reference platform designed for AWS-connected vehicle workloads. The affected component is the SitewiseCustomFunction Lambda Function Handler - an AWS Lambda function likely interfacing with AWS IoT SiteWise for vehicle telemetry processing. The root cause is CWE-284 (Improper Access Control), specifically an IAM permission configuration that grants the Lambda execution role more privileges than the principle of least-privilege requires. CPE cpe:2.3:a:nxp-auto-goldvip:gvip:*:*:*:*:*:*:*:* covers the product; the wildcard version field implies all historical releases may carry the misconfiguration, though the vendor's own statement that the fix began at 1.13.0 indicates versions between the description's ceiling (1.4.0) and 1.12.x are also likely affected - a range not precisely bounded by the NVD CPE entry.
RemediationAI
Upgrade GoldVIP to version 1.15.0, the confirmed patched release available at https://github.com/nxp-auto-goldvip/gvip/releases/tag/goldvip-1.15.0. The vendor notes that remediation of the IAM permissions began at version 1.13.0, so any release at or above that threshold addresses the misconfiguration, with 1.15.0 being the most complete fix. For environments unable to upgrade immediately, restrict IAM role trust policies and resource-based policies on the affected Lambda function to enforce least-privilege boundaries manually - specifically, audit the execution role attached to SitewiseCustomFunction and remove any wildcard or overly broad permissions not required for its core IoT SiteWise operations. Additionally, the vendor has requested that the AWS SAR application repository update or deprecate the older GoldVIP listing, so operators sourcing from SAR should verify they are not deploying a stale version. No other workarounds are formally documented.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today