Three Vulnerabilities in the Bendix EC80 Brake Control Unit: Risk to ABS and Power Steering

The Bendix EC80 brake control unit, installed on trucks and commercial vehicles in North America, has three vulnerabilities that can compromise essential functions such as ABS, power steering assist, speedometer, and traction control. The advisory published by CISA on August 25, 2026 describes the flaws and mitigations. The vulnerabilities were reported by Ben Gardiner of the National Motor Freight Traffic Association (NMFTA).

The Three Vulnerabilities in Technical Detail

The first, identified as CVE-2026-67560, is a stack-based buffer overflow (CWE-121). An attacker on a network adjacent to the vehicle, without requiring privileges or user interaction but with high attack complexity, can send a payload that crashes the ECU. In some cases the payload can execute arbitrary code remotely or inject malicious traffic on the CAN bus. Consequences can include loss of ABS, power steering assist, speedometer reading, and gear shifting capabilities. The CVSS v3.1 score is 7.5 (High); version 4.0 raises it to 7.7.

The second, CVE-2026-68967, is an out-of-bounds write (CWE-787). With low attack complexity, it allows establishing an arbitrary write primitive, causing the ECU to crash. The v3.1 vector is 6.5 (Medium), while CVSS v4.0 rates it 7.1 (High) due to the high impact on integrity.

The third, CVE-2026-71396, involves the use of hard-coded credentials (CWE-798). By exploiting it, an attacker can disable automatic traction control. The CVSS v3.1 score is 5.4 (Medium); v4.0 rates it 5.3 (Medium).

All three require the attacker to be on an adjacent network, for example on the same vehicle network or with access to the CAN bus. They are not directly exploitable from the Internet, but unprotected remote access to the in-vehicle network can expose them.

Affected Products and Versions

The affected products are eleven configurations of the EC80 family, with three distinct vulnerable firmware versions.

With firmware Z228999:

• EC80ESP+ J1708
• EC80ESP+ 6S/6M
• EC80ESP+ PLC
• EC80ESP+ 2nd CAN
• EC80ESP+ Integrated TPMS

With firmware Z266494:

• EC80ESP 6S/6M
• EC80ESP PLC
• EC80ESP 2nd CAN
• EC80ESP CAN Gateway

With firmware Z286098:

• EC80ESP 4S/4M
• EC80ESP PLC

Bendix recommends updating the firmware to the correct version indicated in the advisory: Z300822 for versions with firmware Z228999, Z302578 for those with Z266494, and Z302579 for those with Z286098. For assistance, contact [email protected].

Risks for Drivers and Fleets

These vulnerabilities are not just an IT problem: they have direct effects on vehicle safety. Loss of ABS can lengthen braking distances, especially on low-grip surfaces. Loss of power steering assist makes the vehicle much harder to control, especially when fully loaded. A non-functioning speedometer exposes drivers to penalties and makes safe driving more difficult. Disabling automatic traction control can cause wheel slip on inclines or slippery surfaces.

The potential impact concerns all fleet operators using commercial vehicles equipped with Bendix EC80, particularly in the United States and Canada, where the devices are distributed. An attacker able to compromise the CAN bus can not only crash the control unit, but also inject false messages that interfere with other vehicle subsystems.

How to Protect Yourself: Updates and Defenses

The first action is to update the control unit firmware to the correct versions indicated by Bendix. The update should be planned and tested before being deployed across the entire fleet, because an interruption of braking service during installation can be dangerous.

CISA also recommends minimizing the network exposure of control devices, ensuring they are not reachable from the Internet. In-vehicle networks and remote devices should be placed behind firewalls and isolated from corporate networks. If remote access is necessary, use VPNs updated to the latest version, keeping in mind that a VPN is only as secure as the connected devices.

Before applying any defensive measure, perform an impact analysis and risk assessment. CISA also encourages reporting suspicious activities according to internal procedures, to allow tracking and correlation with other incidents. Recommended practices for control system security are available at cisa.gov/ics.

Discovery and Current Status

The vulnerabilities were reported to CISA by Ben Gardiner of NMFTA, the association representing road freight transport in the United States. At the time the advisory was published, CISA had not received reports of active public exploitation specifically targeting these vulnerabilities. Consequently, the three CVEs are not listed in the KEV catalog, the list of known exploited vulnerabilities.

This does not reduce the urgency of updating: the presence of hard-coded credentials and arbitrary write primitives makes the flaws particularly dangerous if combined with access to the in-vehicle network. The speed with which Bendix produced the corrected firmware and the same-day CISA advisory suggest coordinated disclosure management. Responsibility now passes to fleet operators.