NMFTA Finds Remote Code Execution Flaws in Bendix Truck Brake Controller
Summary
NMFTA says reverse-engineering found serious flaws in Bendix EC80 brake controllers, including potential remote code execution and traction-control disablement. Tests triggered ECU failures; a 2024 recall covered an estimated 450,000 units.
Key points
- NMFTA researcher Ben Gardiner found vulnerabilities while comparing pre- and post-update firmware from three Bendix EC80 units.
- The flaws included buffer-handling issues that could crash the ECU and enable remote code execution, a hardcoded password that could disable traction control, and another theoretical crash/code-execution path.
- J2497, also known as PLC4TRUCKS, can reportedly be reached remotely using a technique tied to an NMFTA vulnerability disclosure in 2022, or through a compromised trailer telematics device.
- Bench and closed-track tests simulated wireless attacks; when a crash was triggered, CAN bus traffic stopped and recovery required disconnecting the battery.
- The tested failure state affected the speedometer, steering assist, shifting, and ABS pulsing. NMFTA said the risk of a crash depends on context and that the attacks do not remove driver control.
- Three OEM recalls in late 2024 covered an estimated 450,000 units. NMFTA said recall-completion rates shown on July 16 ranged from 0% to 99% for associated identifiers.
Article Details
- Attack Vectors
- Buffer-handling flaws in the Bendix EC80 firmware could crash the ECU and enable remote code execution.
- J2497 can be reached remotely or through a compromised trailer telematics device.
- Researchers used a software-defined radio to inject signals through a truck’s diagnostic port during closed-track testing.
- A hardcoded password could disable traction control.
- A separate flaw was described as providing a theoretical path to an ECU crash and code execution.
- Defensive Notes
- Bendix shipped a firmware fix through safety recalls issued by three OEMs.
- The article points to NHTSA’s public recall-completion tracker for checking completion rates associated with the recall.
MITRE ATT&CK
People
Vendors
Products
EC80Black Hat — The National Motor Freight Traffic Association (NMFTA) says a 2024 safety recall for Bendix’s EC80 heavy-truck brake controller quietly fixed a set of serious vulnerabilities, including a wirelesslyJ2497It communicates over J2497, also known as PLC4TRUCKS, a powerline databus that has served since 2001 as the only industry-standard way to meet federal trailer ABS warning-light requirements.