Bendix EC80 ESP CVE-2026-67560

Exploitation requires adjacent network access to the vehicle's internal CAN bus or J1708 serial bus - this vulnerability cannot be triggered over the public internet. Practical adjacency is achievable via: physical connection to an OBD-II or dedicated diagnostic port on the vehicle, compromise of a telematics or fleet-management device that has CAN bus access, or proximity to a vehicle whose CAN network is bridged through a wireless gateway. PR:N indicates no authentication to the ECU is required once adjacency is achieved. The AC:H metric limits exploitation: a functional crafted payload requires knowledge of the EC80ESP firmware's memory layout and stack structure, raising the attacker skill bar above commodity tooling. No special non-default configuration of the ECU is stated as a prerequisite - the vulnerability appears to exist in the ECU's default operational state. Limiting factors: physical or adjacent-network proximity is mandatory; remote internet-based exploitation is not possible given AV:A.

The CVSS 4.0 score of 7.7 reflects high impact to the vulnerable system (VC:H/VI:H/VA:H) offset by adjacent-network requirement (AV:A) and high attack complexity (AC:H). The provided CVSS 4.0 vector assigns SC:N/SI:N/SA:N (no subsequent system impact), which appears to understate the real-world consequence: arbitrary CAN bus injection by definition affects downstream vehicle ECUs responsible for ABS, steering, and shifting - a scope that arguably warrants SI:H/SA:H. No EPSS score was supplied, and the vulnerability is not listed in the CISA KEV catalog, so exploitation probability and confirmed active exploitation remain unquantified. The safety-critical deployment context substantially elevates practical risk beyond what the base score alone conveys: a single successfully exploited vehicle ECU on a commercial fleet - even for a mid-sized regional trucking operator - could produce a safety incident with liability and regulatory consequences disproportionate to the CVSS number. The AC:H metric provides modest mitigation, as a functional exploit requires firmware-level knowledge to craft a working payload. No patch version has been confirmed, heightening urgency for compensating controls.

An attacker with access to a vehicle's CAN bus or J1708 interface - via a compromised telematics unit, a malicious OBD-II dongle plugged in during a service stop, or physical proximity to an unlocked diagnostic port - sends a crafted oversized packet to the EC80ESP ECU. The payload overflows a stack buffer, overwrites the return address, and redirects execution to attacker-controlled code or injects forged CAN messages that disable ABS or issue false steering commands. No public proof-of-concept exploit code has been identified at time of analysis, and the AC:H complexity metric indicates exploit development requires non-trivial firmware analysis.