Bendix EC80 brake controller flaws expose ABS, steering to remote attack
The hardcoded credentials alone would be disqualifying; the stack buffer overflow that delivers arbitrary CAN bus injection makes this a safety-critical patch, not a routine ECU update.
TL;DR
CISA published an advisory for the Bendix EC80 Brake ECU covering three vulnerabilities across eleven firmware variants. CVE-2026-67560, a stack-based buffer overflow scored at CVSS 7.5, allows remote code execution and arbitrary CAN bus injection: an attacker could disable ABS, steering assist, speedometer, and shifting. CVE-2026-71396 exposes hard-coded credentials usable to kill automatic traction control. Bendix has released firmware patches for all affected versions. The advisory is silent on whether fielded vehicles should be taken offline pending updates.
CISA's advisory for the Bendix EC80 Brake ECU lands differently than most ICS alerts. The affected product isn't a PLC on a factory floor or a SCADA controller in a substation. It's a brake controller that ships in heavy trucks, buses, and emergency vehicles across the United States and Canada. The three CVEs disclosed don't threaten data exfiltration or process disruption in the usual ICS sense. They threaten the braking system.
CVE-2026-67560 is the one that matters most. With a CVSS 3.1 score of 7.5 and a CVSS 4.0 score of 7.7, it's a stack-based buffer overflow where two things happen: remote code execution and arbitrary CAN bus injection. The CAN bus injection is the operational nightmare. Once an attacker can write arbitrary traffic to the vehicle's CAN bus, they're not just crashing the ECU. They can spoof messages that disable ABS, kill steering assist, blank the speedometer, and lock out shifting. The advisory spells this out explicitly. This isn't hypothetical.
The hard-coded credentials in CVE-2026-71396 are embarrassing in a different way. Using baked-in credentials in a safety-critical embedded controller in 2026 isn't a design oversight; it's a category error. The impact is narrower (disablement of automatic traction control) but the presence of hard-coded creds suggests an engineering culture that wasn't treating this controller as a security boundary. That's worth noting when the same controller handles braking.
Bendix has released firmware patches for all eleven affected variants, mapping each to a specific update version. The remediation table in the advisory is unusually thorough for an ICS notice. Fleet operators need to know exactly which firmware to flash. What's missing is any guidance on interim measures. The advisory doesn't say whether vehicles should be taken off the road pending updates. For a vulnerability that requires only adjacent network access and no authentication to achieve remote code execution, that silence is loud. Fleet managers and defense logistics operators with EC80-equipped vehicles need to make that call themselves, and they need to make it before someone else does.
Published ·Deep Fathom