Description (CNA)
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Bendix / EC80ESP+ J1708 | affected Z228999; unaffected Z300822 |
| Bendix / EC80ESP+ 6S/6M | affected Z228999; unaffected Z300822 |
| Bendix / EC80ESP+ PLC | affected Z228999; unaffected Z300822 |
| Bendix / EC80ESP+ 2nd CAN | affected Z228999; unaffected Z300822 |
| Bendix / EC80ESP+ Integrated TPMS | affected Z228999; unaffected Z300822 |
| Bendix / EC80ESP 6S/6M | affected Z266494; unaffected Z302578 |
| Bendix / EC80ESP PLC | affected Z266494; unaffected Z302578 |
| Bendix / EC80ESP 2nd CAN | affected Z266494; unaffected Z302578 |
| Bendix / EC80ESP CAN Gateway | affected Z266494; unaffected Z302578 |
| Bendix / EC80ESP 4S/4M | affected Z286098; unaffected Z302579 |
| Bendix / EC80ESP PLC | affected Z286098; unaffected Z302579 |
CWE
CWE-121
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json
ADP enrichment
No English description supplied.
No references supplied.