Truck Brake Controller Recall Doubles as Hidden Security Fix
The National Motor Freight Traffic Association (NMFTA) has revealed that a 2024 safety recall for Bendix's EC80 heavy-truck brake controller quietly fixed a set of serious vulnerabilities, including a wirelessly reachable remote code execution flaw.
These findings were detailed by NMFTA senior cybersecurity research engineer Ben Gardiner at the Black Hat USA 2026 conference. The EC80 electronic control unit (ECU) handles anti-lock braking, traction control, and stability functions on heavy commercial vehicles.
Communication Over J2497
The EC80 communicates over J2497, also known as PLC4TRUCKS, a powerline databus that has served since 2001 as the only industry-standard way to meet federal trailer ABS warning-light requirements.
In late 2024, three OEMs that integrate the EC80 issued recalls — covering an estimated 450,000 units — after Bendix identified memory corruption issues that could take the ECU offline. Bendix attributed the issue to line noise on J2497 and shipped a fix.
Vulnerabilities Discovered
Gardiner reverse-engineered pre- and post-update firmware from three EC80 units, one from each affected OEM, and found that the update deleted dozens of functions. Inside that deleted code, the researcher identified several vulnerabilities, including buffer-handling flaws that could crash the ECU and enable remote code execution.
A hardcoded password could disable traction control, and a flaw offered a theoretical path to both a crash and code execution. The security implications and potential real-world impact are significant, as J2497 can be reached remotely or through a compromised trailer telematics device.
Testing and Results
NMFTA researchers tested the potential impact of the new vulnerabilities in a bench environment and, for closed-track road tests, used a software-defined radio to inject signals through a truck's diagnostic port, simulating a wireless attack.
Driving below 5 mph and around 9 mph, they observed that CAN bus traffic stopped entirely once the crash was triggered, and that recovering the ECU always required disconnecting the battery. This denial-of-service (DoS) state consistently caused loss of speedometer, steering assist, and shifting, as well as ABS pulsing.
Context and Risk
Asked whether those real-world effects could put a driver at risk of a crash or be used to immobilize a truck, for example during a cargo theft operation, NMFTA noted that the outcome depends heavily on context. Driver agreements would likely bar operating a truck in the affected state, with NMFTA noting that recovery needs a battery disconnect and, in one case, a dealer tool.
However, causing a crash directly isn't clear-cut because the attacks don't take away the driver's control of the vehicle. Nevertheless, NMFTA noted the impacts were serious enough for Bendix to issue a recall.
Lack of CVE Identifier
None of the vulnerabilities received a CVE identifier despite being fixed, which may obscure the security significance of what was framed publicly as a safety-only update. NMFTA contacted Bendix and briefed two of the three affected OEMs, along with NHTSA and Transport Canada, before making its findings public.
NMFTA pointed to NHTSA's public recall-completion tracker, which on July 16 showed recall completion rates ranging between 0 and 99% for identifiers associated with this recall. NMFTA believes that recall completion rates commonly plateau around 80% industry-wide due to factors like lost equipment and underreporting.
After the Black Hat talk, NMFTA published a 179-page technical whitepaper detailing the findings. Bendix has not responded to SecurityWeek's request for comment.
Source: SecurityWeek