Skip to content
OpenAdvisories
High ICSA-26-237-05 3 CVEs

Bendix EC80 Brake ECU

Published Aug 25, 2026 · Updated Aug 25, 2026

Vendor: Bendix Product: EC80ESP 4S/4M Product: EC80ESP CAN Gateway Product: EC80ESP+ 2nd CAN Product: EC80ESP+ 6S/6M Product: EC80ESP+ Integrated TPMS Product: EC80ESP+ J1708 Product: EC80ESP+ PLC

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, shifting capabilities, or disable automatic traction control.

Vulnerabilities 3

  • High 7.5
    CVE-2026-67560

    Stack-based Buffer Overflow in Bendix EC80 Brake ECU

    Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS…

    Bendix EC80ESP 4S/4M EC80ESP+ 6S/6M EC80ESP+ 2nd CAN
  • Medium 6.5
    CVE-2026-68967

    Out-of-bounds Write in Bendix EC80 Brake ECU

    Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU.

    Bendix EC80ESP 4S/4M EC80ESP+ 6S/6M EC80ESP+ 2nd CAN
  • Medium 5.4
    CVE-2026-71396

    Use of Hard-coded Credentials in Bendix EC80 Brake ECU

    Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

    Bendix EC80ESP CAN Gateway EC80ESP+ J1708 EC80ESP+ PLC

Revision history

  1. #1

    Initial Publication

References