CVE-2026-67560: Stack-based Buffer Overflow in Bendix EC80 Brake ECU
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bendix EC80 Brake ECU firmwareto a version that resolves this vulnerability.Fixed in Z300822 - Upgrade
Upgrade
Bendix EC80 Brake ECU firmwareto a version that resolves this vulnerability.Fixed in Z302578 - Upgrade
Upgrade
Bendix EC80 Brake ECU firmwareto a version that resolves this vulnerability.Fixed in Z302579
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation requires adjacent-network access. No privileges or user interaction are required.
How difficult is exploitation expected to be?
The CVSS vector rates attack complexity as high. Successful exploitation requires a crafted payload despite the lack of required privileges or user interaction.
What are the potential operational consequences of a successful exploit?
An attacker may be able to crash the ECU, execute arbitrary code remotely, or inject arbitrary CAN bus traffic. Reported effects include loss of ABS, steering assist, speedometer, and shifting functions.