The Bendix EC80 electronic control unit (ECU), used in heavy trucks for anti-lock braking, traction control, and stability, was subject to a 2024 safety recall that also fixed multiple security vulnerabilities. NMFTA research revealed that the recall firmware update removed vulnerable code that included buffer-handling flaws enabling remote code execution and denial-of-service (DoS) conditions, as well as a hardcoded password that could disable traction control. The ECU communicates via the J2497 (PLC4TRUCKS) powerline databus, which can be accessed remotely or through compromised trailer telematics devices. Exploitation could cause ECU crashes, stopping CAN bus traffic and disabling speedometer, steering assist, shifting, and ABS pulsing. Recovery requires battery disconnection and sometimes dealer intervention. Approximately 450,000 EC80 units were recalled, but completion rates vary. NMFTA disclosed these vulnerabilities publicly at Black Hat USA 2026, noting the lack of CVE assignments and the framing of the update as safety-only. The findings were shared with OEMs, NHTSA, and Transport Canada prior to disclosure.

Exploitation of the identified vulnerabilities could cause denial-of-service conditions in the EC80 brake controller, resulting in loss of critical vehicle functions such as speedometer, steering assist, shifting, and ABS pulsing. While direct crash causation is unclear, these impacts could impair vehicle operation and potentially be used to immobilize trucks, for example during cargo theft. Recovery from the DoS state requires battery disconnection and possibly dealer tools. The vulnerabilities include remote code execution potential and disabling of traction control via a hardcoded password, posing significant security risks to heavy commercial vehicles. The recall addressed these issues, but incomplete recall completion leaves some vehicles potentially vulnerable.

A safety recall issued in late 2024 for the Bendix EC80 brake controller included firmware updates that patched the identified vulnerabilities. Operators and fleet managers should ensure that affected vehicles have completed the recall update. NMFTA referenced NHTSA’s recall-completion tracker, which shows varying completion rates, indicating some vehicles may remain unpatched. No additional mitigation steps are noted or required beyond applying the official recall update. Monitoring recall completion status and coordinating with OEMs and authorized dealers for updates is recommended.