Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix

A 2024 safety recall for Bendix’s EC80 heavy-truck brake controller, initially issued to address memory corruption issues, has been revealed to contain a significant set of vulnerabilities, including a remotely accessible code execution flaw. Researchers at the National Motor Freight Traffic Association (NMFTA) discovered these flaws after reverse-engineering firmware updates, highlighting a potential risk of denial-of-service attacks and even vehicle immobilization. Despite the severity of the issues, the vulnerabilities were not assigned CVE identifiers, raising concerns about their visibility and potential for exploitation.