Bendix Brake Controller Recall Uncovers Major Cyber Vulnerabilities

The Recall and Its Hidden Significance

At the Black Hat USA 2026 conference, significant revelations emerged about the Bendix EC80 heavy-truck brake controller. The National Motor Freight Traffic Association (NMFTA) disclosed that a 2024 safety recall not only addressed crucial safety issues but also surprisingly rectified serious cybersecurity vulnerabilities. NMFTA's senior cybersecurity research engineer Ben Gardiner detailed these findings, pointing out that the recall, initially billed as a safety procedure, was driven by underlying security concerns, including a wirelessly accessible remote code execution vulnerability.

Technical Underpinnings of the EC80

The EC80 electronic control unit (ECU) serves vital functions including anti-lock braking, traction control, and stability management for heavy commercial vehicles. It communicates through the industry-standard J2497 protocol, known as PLC4TRUCKS, since 2001 — a critical system for meeting federal trailer ABS warning-light requirements. As of late 2024, a recall was issued affecting three original equipment manufacturers (OEMs) whose vehicles utilized the EC80, encompassing an estimated 450,000 units. These recalls were triggered after Bendix identified memory corruption issues that could incapacitate the ECU, an insight linked to electromagnetic interference on the J2497 line.

Exploited Vulnerabilities Identified

Through reverse engineering efforts, Gardiner analyzed the firmware of three EC80 units, representing each affected OEM. He discovered that the updates deployed to rectify the issues involved the deletion of numerous code functions that housed various vulnerabilities. Among those were:

• Buffer-handling flaws that posed risks of crashing the ECU;
• A hardcoded password that could effectively disable traction control;
• A potential vulnerability that could lead to both ECU crashes and code execution.

These vulnerabilities, left unaddressed, could have significant implications for vehicle operation and safety.

Remote Access and Attack Methods

Gardiner explained that the vulnerabilities could be accessed remotely through various means, including compromised trailer telematics devices. The research included simulations of potential attacks using a software-defined radio to inject malicious signals through the truck's diagnostic port. In closed-track tests, when exerting attacks below 5 mph and around 9 mph, the NMFTA researchers noted critical failures in CAN bus traffic following a triggered crash event. These failures resulted in a total loss of speedometer readings, steering assistance, and the capability for gear shifting, as well as causing issues like ABS pulsing.

Potential Impacts on Vehicle Safety

NMFTA representatives affirmed that while the impact of these vulnerabilities was serious enough for a recall, categorically determining whether the exploit could lead to an accident is complex. The likelihood of a successful vehicle immobilization or crash correlates with specific situations, as existing driver protocols are designed to prevent vehicle operation under compromised conditions. Recovery from the denial-of-service (DoS) state induced by these vulnerabilities generally requires disconnecting the battery, and in some scenarios, specialized dealer tools. Nevertheless, the potential for exploitation remains a troubling concern for vehicle safety.

Overlooked Vulnerabilities and CVE Identifiers

Despite the significant implications of the vulnerabilities identified, Gardiner noted that they did not receive Common Vulnerabilities and Exposures (CVE) identifiers. This absence raises concerns regarding the security priorities communicated publicly by Bendix, which framed the recall primarily as a safety-focused measure. NMFTA took the proactive step of briefing Bendix and the involved OEMs, along with the National Highway Traffic Safety Administration (NHTSA) and Transport Canada, prior to making its findings public. This step underlines the urgency in addressing security concerns alongside safety measures.

The Recall Completion Challenge

With regard to the ongoing recall efforts, NMFTA referenced the public recall-completion tracker run by the NHTSA, revealing that as of July 16, completion rates for the recall ranged from 0% to 99% depending on the identifier. Typically, NMFTA notes that recall completion rates tend to plateau around 80%, often hampered by various factors such as lost equipment and underreporting of completed recalls. This highlights an ongoing challenge in ensuring that all affected units are returned and fixed, especially amid essential safety and cybersecurity issues.

NMFTA's Ongoing Research and Recommendations

In the aftermath of the Black Hat presentation, NMFTA disseminated a detailed 179-page technical whitepaper clarifying the vulnerabilities and the importance of addressing both safety and cybersecurity in the automotive arena. While Bendix has yet to respond to requests for comments regarding these findings, the incident underscores the critical intersection of automotive safety and cybersecurity.

Key Takeaways

• The Bendix EC80 recall doubled as a hidden fix for serious cyber vulnerabilities, including remote code execution risks.
• Approximately 450,000 units were affected by the recall, highlighting the widespread implications of the issues.
• Security vulnerabilities could be accessed remotely, posing safety risks to heavy commercial vehicles.
• None of the vulnerabilities received a CVE identifier, raising concerns about the communication of their significance.
• Recall completion rates may stall at approximately 80%, complicating remediation efforts for affected units.

Conclusion

This case emphasizes the growing need for a dual focus on safety and cybersecurity in the automotive industry. As technology continues to advance, manufacturers must remain vigilant in addressing vulnerabilities that could jeopardize public safety, ensuring that both software and hardware are responsive to emerging threats.