A 2024 safety recall for Bendix’s EC80 heavy-truck brake controller did more than fix a line-noise problem, according to research presented at Black Hat USA 2026. Ben Gardiner, a senior cybersecurity research engineer at the National Motor Freight Traffic Association (NMFTA), said the update also silently patched a set of serious security vulnerabilities that were never publicly disclosed as such.
The EC80 is an electronic control unit that manages anti-lock braking, traction control, and stability systems on heavy commercial vehicles. It communicates over J2497 (PLC4TRUCKS), a powerline databus that has been the industry-standard way to meet federal trailer ABS warning-light requirements since 2001.
In late 2024, three OEMs that integrate the EC80 issued recalls covering an estimated 450,000 units after Bendix attributed intermittent ECU crashes to line noise on J2497 and shipped a fix. Gardiner reverse-engineered pre- and post-update firmware from three EC80 units, one from each affected OEM, and found the update had quietly deleted dozens of functions.
What was hidden in the deleted code
Inside that removed code, Gardiner identified several distinct vulnerabilities: buffer-handling flaws capable of crashing the ECU and enabling remote code execution, a hardcoded password that could disable traction control, and an additional flaw offering a theoretical path to both a crash and code execution.
J2497 can be reached remotely, a technique tied to a vulnerability NMFTA previously disclosed in 2022, or through a compromised trailer telematics device. Using a software-defined radio to inject signals through a truck’s diagnostic port on closed-track tests, researchers triggered crashes at low speeds (below 5 mph and around 9 mph) that halted CAN bus traffic entirely, causing loss of speedometer, steering assist, and shifting, along with ABS pulsing. Recovery consistently required disconnecting the battery, and in one case a dealer tool.
Uncertain real-world risk, but serious enough to recall
NMFTA told SecurityWeek the practical impact depends heavily on context. The attacks do not remove the driver’s control of the vehicle, so a direct link to a crash isn’t clear-cut, though the denial-of-service state would likely violate driver operating agreements and could plausibly be exploited during scenarios such as cargo theft.
Gardiner noted that none of the vulnerabilities were assigned a CVE despite being fixed, arguing this may have obscured the security significance of what was publicly framed as a safety-only recall. NMFTA briefed Bendix, two of the three affected OEMs, NHTSA, and Transport Canada before going public, and points to NHTSA’s recall-completion tracker, which as of July 16 showed completion rates ranging from 0 to 99 percent across identifiers tied to the recall. NMFTA has published a 179-page technical whitepaper detailing its findings. Bendix has not responded to a request for comment.