News Date: 2026-08-07
A safety recall covering roughly 450,000 heavy-truck brake controllers also served as an unpublicized cybersecurity repair, according to research presented at Black Hat USA 2026. The findings raise questions about how vehicle manufacturers disclose security defects when software updates are distributed through traditional safety campaigns.
A Critical Controller With a Long Reach
The Bendix EC80 electronic control unit supports anti-lock braking, traction control and vehicle stability functions. It communicates through J2497, commonly known as PLC4TRUCKS, a powerline data network used to support trailer brake warning requirements.
Vehicle manufacturers issued recalls in late 2024 after Bendix identified memory corruption that could cause the controller to stop operating. The public explanation focused on electrical noise and reliability. However, National Motor Freight Traffic Association researcher Ben Gardiner compared firmware from before and after the update and discovered that dozens of functions had been removed.
The deleted code reportedly contained buffer-handling vulnerabilities capable of crashing the controller and potentially enabling remote code execution. Researchers also found a hardcoded password that could disable traction control and another weakness that offered a theoretical path to code execution.
Testing Revealed Operational Consequences
In controlled road tests, researchers injected signals through a diagnostic connection to simulate a wireless attack. Triggering the denial-of-service condition stopped CAN bus traffic and caused the loss of speedometer data, steering assistance and gear-shifting functionality, while also producing anti-lock brake pulsing. Restoring the controller required disconnecting the vehicle battery.
The vulnerabilities could potentially be reached through J2497 or a compromised trailer telematics device. The attack did not directly remove the driver's physical control, but an immobilized truck or disabled safety function could still create serious operational and cargo-security risks.
Security Guidance for Fleet Operators
- Verify that every affected vehicle has received the recall update.
- Inventory brake-controller and telematics firmware versions.
- Restrict unauthorized diagnostic and trailer-network equipment.
- Monitor telematics platforms for unusual access or configuration changes.
- Include vehicle electronic controllers in incident-response planning.
I believe the absence of CVE identifiers is particularly concerning. Fleet operators may prioritize a recall differently if they understand that it also closes a potential remote attack path. Safety and cybersecurity are no longer separate disciplines in connected vehicles. Vendors should clearly describe both dimensions so owners can make informed risk decisions and measure update completion accurately.