Skip to content
OpenAdvisories
High · 7.5 CVE-2026-67560 EUVD-2026-67275GHSA-g3jp-7qm3-5x6r

Stack-based Buffer Overflow in Bendix EC80 Brake ECU

Published Aug 27, 2026 · Updated Aug 28, 2026 · Assigned by icscert

Vendor: Bendix Product: EC80ESP 4S/4M Product: EC80ESP CAN Gateway Product: EC80ESP+ 2nd CAN Product: EC80ESP+ 6S/6M Product: EC80ESP+ Integrated TPMS Product: EC80ESP+ J1708 Product: EC80ESP+ PLC

Description

Bendix EC80 Brake ECU
is vulnerable to a stack-based buffer overflow, which may allow an
attacker to crash the ECU. A crafted payload can then be used to
remotely execute arbitrary code or inject arbitrary CAN bus traffic.
This could cause the loss of the ABS function, steering assist,
speedometer, and shifting.

Affected products

VendorProductAffectedFixed
Bendix EC80ESP+ J1708 Z228999 Z300822
Bendix EC80ESP+ 6S/6M Z228999 Z300822
Bendix EC80ESP+ PLC Z228999 Z300822
Bendix EC80ESP+ 2nd CAN Z228999 Z300822
Bendix EC80ESP+ Integrated TPMS Z228999 Z300822
Bendix EC80ESP 6S/6M Z266494 Z302578
Bendix EC80ESP PLC Z266494, Z286098 Z302578
Bendix EC80ESP 2nd CAN Z266494 Z302578
Bendix EC80ESP CAN Gateway Z266494 Z302578
Bendix EC80ESP 4S/4M Z286098 Z302579

Advisories 1

References