Read the docs
TI-2026-47741 Aliases CVE-2026-67560GHSA-g3jp-7qm3-5x6r

Stack-based Buffer Overflow in Bendix EC80 Brake ECU

Priority LOW 36CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed EC80ESP+ J1708 (Bendix): Z300822EC80ESP+ 6S/6M (Bendix): Z300822+8 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BendixEC80ESP+ J1708Z228999Z300822Patch availableCNA
BendixEC80ESP+ 6S/6MZ228999Z300822Patch availableCNA
BendixEC80ESP+ PLCZ228999Z300822Patch availableCNA
BendixEC80ESP+ 2nd CANZ228999Z300822Patch availableCNA
BendixEC80ESP+ Integrated TPMSZ228999Z300822Patch availableCNA
BendixEC80ESP 6S/6MZ266494Z302578Patch availableCNA
BendixEC80ESP PLCZ266494Z302578Patch availableCNA
BendixEC80ESP 2nd CANZ266494Z302578Patch availableCNA
BendixEC80ESP CAN GatewayZ266494Z302578Patch availableCNA
BendixEC80ESP 4S/4MZ286098Z302579Patch availableCNA
BendixEC80ESP PLCZ286098Z302579Patch availableCNA
  • EC80ESP+ J1708 VendorBendix Affected Z228999 Fixed in Z300822 Patch available CNA
  • EC80ESP+ 6S/6M VendorBendix Affected Z228999 Fixed in Z300822 Patch available CNA
  • EC80ESP+ PLC VendorBendix Affected Z228999 Fixed in Z300822 Patch available CNA
  • EC80ESP+ 2nd CAN VendorBendix Affected Z228999 Fixed in Z300822 Patch available CNA
  • EC80ESP+ Integrated TPMS VendorBendix Affected Z228999 Fixed in Z300822 Patch available CNA
  • EC80ESP 6S/6M VendorBendix Affected Z266494 Fixed in Z302578 Patch available CNA
  • EC80ESP PLC VendorBendix Affected Z266494 Fixed in Z302578 Patch available CNA
  • EC80ESP 2nd CAN VendorBendix Affected Z266494 Fixed in Z302578 Patch available CNA
  • EC80ESP CAN Gateway VendorBendix Affected Z266494 Fixed in Z302578 Patch available CNA
  • EC80ESP 4S/4M VendorBendix Affected Z286098 Fixed in Z302579 Patch available CNA
  • EC80ESP PLC VendorBendix Affected Z286098 Fixed in Z302579 Patch available CNA

Remediation

  • Fix · CNA EC80ESP+ J1708 (Bendix) Fixed in Z300822
  • Fix · CNA EC80ESP+ 6S/6M (Bendix) Fixed in Z300822
  • Fix · CNA EC80ESP+ PLC (Bendix) Fixed in Z300822
  • Fix · CNA EC80ESP+ 2nd CAN (Bendix) Fixed in Z300822
  • Fix · CNA EC80ESP+ Integrated TPMS (Bendix) Fixed in Z300822
  • Fix · CNA EC80ESP 6S/6M (Bendix) Fixed in Z302578
  • Fix · CNA EC80ESP PLC (Bendix) Fixed in Z302578
  • Fix · CNA EC80ESP 2nd CAN (Bendix) Fixed in Z302578
  • Fix · CNA EC80ESP CAN Gateway (Bendix) Fixed in Z302578
  • Fix · CNA EC80ESP 4S/4M (Bendix) Fixed in Z302579
  • Fix · CNA EC80ESP PLC (Bendix) Fixed in Z302579

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67560
  2. 2026-10-03 Alias added: GHSA-g3jp-7qm3-5x6r

References

Other 2

  • TI-2026-48478 Out-of-bounds Write in Bendix EC80 Brake ECU CVSS 4.0HIGH 7.1
  • TI-2026-50035 Use of Hard-coded Credentials in Bendix EC80 Brake ECU CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences