Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-71396 EUVD-2026-67314GHSA-2x2w-768p-8379

Use of Hard-coded Credentials in Bendix EC80 Brake ECU

Published Aug 27, 2026 · Updated Aug 28, 2026 · Assigned by icscert

Vendor: Bendix Product: EC80ESP 4S/4M Product: EC80ESP CAN Gateway Product: EC80ESP+ 2nd CAN Product: EC80ESP+ 6S/6M Product: EC80ESP+ Integrated TPMS Product: EC80ESP+ J1708 Product: EC80ESP+ PLC

Description

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

Affected products

VendorProductAffectedFixed
Bendix EC80ESP+ J1708 Z228999 Z300822
Bendix EC80ESP+ 6S/6M Z228999 Z300822
Bendix EC80ESP+ PLC Z228999 Z300822
Bendix EC80ESP+ 2nd CAN Z228999 Z300822
Bendix EC80ESP+ Integrated TPMS Z228999 Z300822
Bendix EC80ESP 6S/6M Z266494 Z302578
Bendix EC80ESP PLC Z266494, Z286098 Z302578
Bendix EC80ESP 2nd CAN Z266494 Z302578
Bendix EC80ESP CAN Gateway Z266494 Z302578
Bendix EC80ESP 4S/4M Z286098 Z302579

Advisories 1

References