Bendix EC80 Hidden RCE and DoS Flaws in Heavy Truck Brake Controllers
A crucial discovery by the National Motor Freight Traffic Association (NMFTA) reveals that a 2024 safety recall for Bendix’s EC80 heavy-truck brake controller covertly addressed a range of severe security vulnerabilities, extending beyond the memory corruption issue Bendix publicly disclosed. These findings, detailed by NMFTA senior cybersecurity research engineer Ben Gardiner at the Black Hat USA 2026 conference, highlight wirelessly reachable remote code execution (RCE) and denial-of-service (DoS) flaws affecting critical safety systems in heavy commercial vehicles. This situation underscores a concerning trend where security fixes are obscured under the guise of safety updates, potentially hindering proper risk assessment and remediation by fleet operators. The recall affected an estimated 450,000 units across three original equipment manufacturers (OEMs).
Technical Analysis of Bendix EC80 Remote Code Execution Vulnerabilities
The Bendix EC80 electronic control unit (ECU) is integral to a truck’s anti-lock braking (ABS), traction control, and stability functions. It communicates primarily over J2497, also known as PLC4TRUCKS, a powerline databus standard since 2001 for federal trailer ABS warning-light requirements. While Bendix initially issued a recall citing memory corruption issues caused by J2497 line noise that could take the ECU offline, NMFTA’s in-depth analysis uncovered a broader spectrum of unacknowledged security concerns.
According to SecurityWeek, Gardiner’s reverse-engineering of pre- and post-update firmware from affected EC80 units revealed that the update deleted dozens of functions, effectively patching several undisclosed vulnerabilities. Among these were buffer-handling flaws capable of crashing the ECU and enabling remote code execution. Additionally, a hardcoded password was found that could disable traction control, along with another flaw providing a theoretical path to both a crash and code execution. The deliberate omission of Common Vulnerabilities and Exposures (CVE) identifiers for these security fixes, despite their severity, raises questions about transparency and accountability in automotive cybersecurity.
Attack Vectors and Simulated Impact of J2497 PLC4TRUCKS Vulnerabilities
The J2497 databus, a core component for these J2497 PLC4TRUCKS vulnerabilities, can be accessed remotely. NMFTA previously disclosed a related vulnerability in 2022 demonstrating remote reachability. Attackers could leverage this, or compromise a trailer telematics device, to inject malicious signals. To assess the real-world implications, NMFTA researchers conducted tests in a bench environment and on a closed track. Using a software-defined radio to inject signals through a truck’s diagnostic port, they simulated a wireless attack scenario.
During these tests, at speeds below 5 mph and around 9 mph, triggering a crash consistently halted CAN bus traffic entirely. Recovery from this denial-of-service state invariably necessitated disconnecting the battery, and in some cases, a dealer tool. The DoS state led to critical operational failures, including the loss of speedometer readings, steering assist, and shifting capabilities, alongside unintended ABS pulsing. While NMFTA noted that direct causation of a truck crash isn’t straightforward because the attacks don’t remove driver control, the serious operational and safety impacts were significant enough to warrant Bendix’s recall. The potential for such disruptions during cargo theft operations or other malicious acts remains a serious concern for the trucking industry.
Actionable Recommendations for Heavy Truck Brake Controller Security
Given the widespread deployment of the Bendix EC80 units—approximately 450,000—and the severity of the hidden vulnerabilities, security professionals and fleet managers must prioritize remediation.
- Prioritize Recall Completion: Fleet operators should immediately verify the recall status of all Bendix EC80 units in their heavy commercial vehicles. According to NHTSA’s public recall-completion tracker, completion rates for this recall vary widely (0-99%), and NMFTA estimates typical industry-wide plateauing at around 80%. Proactive completion of these firmware updates is the single most critical step to mitigate the disclosed RCE and DoS risks, addressing the Bendix EC80 remote code execution threat.
- Monitor J2497 Communications: Implement monitoring solutions for unusual or unauthorized traffic on the J2497 (PLC4TRUCKS) databus. Anomalous activity could indicate attempted exploitation of these or similar vulnerabilities.
- Secure Telematics Devices: Strengthen the security posture of all trailer telematics devices. As these can serve as an entry point for remote exploitation of J2497, ensure they are regularly patched, configured securely, and segmented from critical vehicle control systems where possible.
- Stay Informed on Hidden Fixes: Security professionals should remain vigilant for “safety-only” recalls that may obscure underlying cybersecurity vulnerabilities. Advocate for transparent disclosure and proper CVE assignments for all security-related fixes.
The NMFTA’s comprehensive 179-page technical whitepaper provides further details, underscoring the depth of these findings and the need for rigorous attention to the cyber-physical security of commercial transportation systems.
Related: Cursor RCE via Malicious Git Executable — Unpatched Vulnerability Alert, CryptoBandits Malware: Tor-Abusing Backdoor & Data Theft