# Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities

> A 2024 NHTSA safety recall of ~445,000 Bendix EC80 electronic brake control units, publicly attributed to J2497 powerline-databus memory corruption, also silently fixed an unpatched wireless remote code execution flaw, buffer-handling issues, a denial-of-service flaw, and a hardcoded password capable of disabling traction control. NMFTA researcher Ben Gardiner disclosed these findings at Black Hat USA 2026 (2026-08-06); none of the fixed flaws ever received a CVE identifier.

- **Published:** 2026-08-07T00:00:00Z
- **Last reviewed:** 2026-08-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1928
- **ID:** TL-2026-1928
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-25922, CVE-2022-26131

## Description

The Bendix EC80 Advanced ECU is an electronic control unit deployed across roughly 450,000 heavy trucks and trailers (Volvo, Mack, International/Navistar, and PACCAR chassis) that governs anti-lock braking (ABS), automatic traction control (ATC), and electronic stability control (ESC). It communicates with trailer ABS modules over SAE J2497, a powerline-carrier (PLC) protocol branded PLC4TRUCKS that has been fielded since 2001 to avoid adding extra tractor-trailer wiring for ABS warning-light compliance.

In late 2024 Bendix and three downstream OEMs (Volvo, Mack, International, PACCAR) filed NHTSA safety recalls (Bendix 24E-086, ~445,208 units; Volvo 24V-790, 126,649 units; Mack 24V-792, 60,450 units; International 24V-818, 105,276 units; PACCAR 24V-915) covering model years 2020-2025. The public justification was that high electrical noise combined with low PLC signal strength -- more likely on trucks towing multiple trailers -- caused the EC80 to incorrectly process J2497 messages, producing 'incorrect message string length and overflow of memory buffers' that could crash the ECU or degrade ABS/ATC/ESC/collision-mitigation performance. Bendix's remedy was a firmware reprogram distributed via its ID 9363 update utility, with owner notifications beginning December 1, 2024.

At Black Hat USA 2026, NMFTA senior research engineer Ben Gardiner revealed that this same firmware update covertly fixed a distinct set of unpatched security vulnerabilities that were never disclosed or assigned CVE identifiers: a wireless remote code execution flaw reachable via the same remote J2497 attack technique NMFTA first flagged in 2022 (CVE-2022-25922 / CVE-2022-26131, CISA advisory ICSA-22-063-01) or, per SecurityWeek's reporting, via a compromised trailer telematics device pivoting onto the brake-controller bus; additional buffer-handling flaws consistent with the 'overflow of memory buffers' language in the NHTSA filings; a separate denial-of-service flaw; and a hardcoded password that could be used to disable traction control. Gardiner's team reverse-engineered pre- and post-update firmware pulled from three EC80 units, finding 'dozens of functions' deleted in the recall update -- the diffing methodology used to surface the covertly-patched flaws. The team then validated real-world impact through bench testing and closed-track road tests, injecting crafted J2497 signals via software-defined radio through/near the diagnostic port and observing complete CAN bus traffic stoppage at speeds below 5 mph and again around 9 mph -- with confirmed loss of speedometer, steering assist, shifting, and ABS pulsing -- requiring a battery disconnect (dealer tool access in one case) to recover the ECU, consistent with Gardiner's 2023 public demonstration of disabling trailer air brakes with a simple two-wire antenna.

The underlying exposure traces to the 2022 NMFTA/Assured Information Security disclosure that J2497 diagnostic functions have no authentication (CVE-2022-25922, CWE-306, CVSS 3.1 9.1, replay-invocable) and that J2497 receivers are susceptible to remote RF-induced signals from up to 12 feet using $300-$10,000 of equipment (CVE-2022-26131, CWE-1319 Improper Protection Against Electromagnetic Fault Injection, CVSS 3.1 9.8 per NVD / 9.3 per ICS-CERT's AV:A-scoped vector). NMFTA pre-briefed Bendix, two of the three affected OEMs, NHTSA, and Transport Canada before the Black Hat talk; Bendix did not respond to SecurityWeek's request for comment. As of July 16, 2026, NHTSA recall-completion data showed a 0-99% range across the five campaigns, with NMFTA estimating an industry-wide completion plateau around 80% due to lost/sold equipment and underreporting. NMFTA is now pushing SAE working groups toward a next-generation J2497 interface that removes non-essential software/diagnostic functions from the powerline channel, since trailers carrying the legacy protocol remain in service 15-30 years.

## MITRE ATT&CK

- T1592.002 Software
- T1588.002 Tool
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1078.001 Default Accounts
- T1552 Unsecured Credentials
- T1499.004 Application or System Exploitation
- T1565.002 Transmitted Data Manipulation
- T1489 Service Stop

## Sources

- [Truck Brake Controllers Safety Recall Doubled as Hidden Security Fix](https://www.securityweek.com/truck-brake-controllers-safety-recall-doubled-as-hidden-security-fix/)
- [Tractor-Trailer Brake Controllers Vulnerable to Remote Hacker Attacks](https://www.securityweek.com/tractor-trailer-brake-controllers-vulnerable-remote-hacker-attacks/)
- [Reversing a Recall: From 'Noise Triggered' to RCE -- Black Hat USA 2026 Whitepaper](https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Gardiner-Tractor_ECU_RE-WP.pdf)
- [Bendix EC80 Recall: Safety and Security Implications](https://nmfta.org/news/bendix-ec80-recall-safety-and-security-implications/)
- [NMFTA's Ben Gardiner Shows How Easy It Is to Disable a Truck's Brakes . . . With a Simple Antenna](https://nmfta.org/news/nmftas-ben-gardiner-shows-how-easy-it-is-to-disable-a-trucks-brakes-with-a-simple-antenna/)
- [ICSA-22-063-01: Trailer Power Line Communications (PLC) J2497](https://www.cisa.gov/news-events/ics-advisories/icsa-22-063-01)
- [CVE-2022-26131 Detail](https://nvd.nist.gov/vuln/detail/CVE-2022-26131)
- [CVE-2022-25922 Detail](https://nvd.nist.gov/vuln/detail/CVE-2022-25922)
- [Bendix Recalls EC80 ECU Over Safety Concerns](https://thebrakereport.com/bendix-recalls-ec80-ecu-over-safety-concerns/)
- [Bendix ECU recall affects over 187K Volvo, Mack trucks](https://www.truckingdive.com/news/bendix-ecu-recall-volvo-mack-trucks/731867/)
- [Widespread ECU recall hits a whopping 105K International trucks](https://www.overdriveonline.com/equipment/article/15707977/widespread-ecu-recall-hits-a-whopping-105k-international-trucks)
- [NHTSA Recalls Data Tracker](https://data.transportation.gov/Automobiles/Recalls-Data/6axg-epim/data_preview)
- [Ben Gardiner - Trailer Shouting: Talking PLC4TRUCKS Remotely with an SDR](https://forum.defcon.org/node/241816)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1928