Researchers say a 2024 safety recall for Bendix’s EC80 heavy-truck brake controller also silently patched serious cybersecurity flaws that could crash the controller or potentially let attackers run code. NMFTA said the update removed vulnerable functions from EC80 firmware used in about 450,000 recalled units integrated by three OEMs. The attack path involved J2497 (PLC4TRUCKS), a trailer powerline communications bus that can be reached remotely in some scenarios, including via compromised trailer telematics devices. No CVE IDs were assigned.
Why it matters: This affects heavy commercial vehicles whose brake, traction-control, and stability systems rely on the EC80, and incomplete recall completion means some trucks may still be exposed. Fleet operators, OEMs, and maintainers should verify recall status and apply the firmware fix, especially for vehicles with reachable trailer communications or telematics exposure.
Eduard Kovacs
2026.08.07
100% relevant
This article establishes the story by revealing that a publicly known 2024 safety recall for the Bendix EC80 was also a hidden security update fixing previously undisclosed, wirelessly reachable vulnerabilities with real-world vehicle impact.
← Back to all stories