The Cybersecurity and Infrastructure Security Agency has warned that vulnerabilities in Bendix EC80 Brake ECU products could let an attacker disrupt several vehicle safety and control functions, including anti-lock braking, steering assist, the speedometer and shifting. The advisory identifies affected equipment deployed in the United States and Canada and rates the most serious issue as high severity.

The affected products include EC80ESP+ variants with J1708, 6S/6M, PLC, second-CAN and integrated-TPMS configurations under version Z228999. The advisory also lists EC80ESP variants under Z266494, including 6S/6M, PLC, second CAN and CAN Gateway models, along with EC80ESP 4S/4M and PLC variants under Z286098. CISA marks each listed product as known affected.

The highest-rated flaw, CVE-2026-67560, is a stack-based buffer overflow. CISA says a crafted payload could crash the electronic control unit and then be used for remote code execution or injection of arbitrary traffic onto the vehicle’s controller area network. The potential consequences include loss of the ABS function, steering assist, speedometer and shifting capabilities. The vulnerability carries a CVSS 3.1 base score of 7.5 and a CVSS 4.0 score of 7.7.

A second issue, CVE-2026-68967, is an out-of-bounds write. The advisory says an attacker could deliver a payload that establishes an arbitrary write primitive and crashes the ECU. CISA assigns the vulnerability a CVSS 3.1 score of 6.5 and a CVSS 4.0 score of 7.1. Unlike the buffer-overflow description, the advisory’s stated impact for this issue centers on crashing the ECU rather than listing the broader vehicle functions.

The third vulnerability, CVE-2026-71396, involves hard-coded credentials. CISA says those credentials could allow an attacker to disable automatic traction control. It has a CVSS 3.1 score of 5.4 and a CVSS 4.0 score of 5.3. The advisory identifies the weakness as CWE-798, or use of hard-coded credentials.

The CVSS vectors place the issues behind an adjacent attack vector, meaning the attacker must be positioned on a nearby network or system path rather than reaching the ECU directly from anywhere on the internet. The buffer overflow is rated high complexity and requires no privileges or user interaction in the listed scoring. The out-of-bounds write and hard-coded-credential flaws are rated low complexity and also require no privileges or user interaction.

Bendix recommends updating EC80 firmware to the latest releases. For the five EC80ESP+ configurations under Z228999, the specified replacement is firmware Z300822. EC80ESP configurations under Z266494 should be updated to Z302578, while the EC80ESP 4S/4M and PLC configurations under Z286098 should be updated to Z302579. Users needing assistance are directed to contact Bendix at [email protected].

CISA also advises organizations to minimize network exposure for control-system devices, keep them off the public internet, isolate control-system networks from business networks and place remote devices behind firewalls. Where remote access is necessary, the agency recommends current secure methods such as updated virtual private networks, while noting that connected devices can affect VPN security. The advisory credits Ben Gardiner of the National Motor Freight Traffic Association with reporting the vulnerabilities.