EUVD-2026-67275
GHSA-g3jp-7qm3-5x6r
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent CAN/J1708 access required (AV:A), high complexity for crafted payload (AC:H), scope changed (S:C) because post-exploitation CAN injection affects other vehicle ECUs beyond the EC80.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
AnalysisAI
Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent network access to the vehicle's internal CAN bus or J1708 serial bus - this vulnerability cannot be triggered over the public internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 reflects high impact to the vulnerable system (VC:H/VI:H/VA:H) offset by adjacent-network requirement (AV:A) and high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult CISA ICS Advisory ICSA-26-237-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05) and contact Bendix directly for firmware update availability; no specific patched firmware version is confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Complete inventory of all commercial vehicles equipped with Bendix EC80ESP or EC80ESP+ ECUs across all configurations (J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, 4S/4M) and assess network connectivity exposure; notify fleet operations and safety teams immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ec80Esp J1708
View allOut-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehic
Hard-coded credentials in the Bendix EC80ESP and EC80ESP+ Brake ECU family allow an adjacent-network attacker to bypass
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today