Skip to content
Fencer Vulns
high 7.5

CVE-2026-67560 json

Stack-based Buffer Overflow in Bendix EC80 Brake ECU

published 2026-08-27 2 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-67275

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

Patch / fix

  • Bendix EC80ESP+ J1708 Z300822
  • Bendix EC80ESP+ 6S/6M Z300822
  • Bendix EC80ESP+ PLC Z300822
  • Bendix EC80ESP+ 2nd CAN Z300822
  • Bendix EC80ESP+ Integrated TPMS Z300822
  • Bendix EC80ESP 6S/6M Z302578
  • Bendix EC80ESP PLC Z302578, Z302579
  • Bendix EC80ESP 2nd CAN Z302578
  • Bendix EC80ESP CAN Gateway Z302578
  • Bendix EC80ESP 4S/4M Z302579

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-237-05 updated cvss 7.5

Bendix EC80 Brake ECU

  • Bendix EC80ESP 2nd CAN Z266494 Bendix EC80ESP 4S/4M Z286098 Bendix EC80ESP 6S/6M Z266494 Bendix EC80ESP CAN Gateway Z266494 Bendix EC80ESP PLC Z266494, Z286098 Bendix EC80ESP+ 2nd CAN Z228999
    +4 more products
    Bendix EC80ESP+ 6S/6M Z228999 Bendix EC80ESP+ Integrated TPMS Z228999 Bendix EC80ESP+ J1708 Z228999 Bendix EC80ESP+ PLC Z228999
    affected: vendor fix, mitigation “Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 7.7 CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.7 CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Bendix EC80ESP+ J1708
  • Bendix EC80ESP+ 6S/6M
  • Bendix EC80ESP+ PLC
  • Bendix EC80ESP+ 2nd CAN
  • Bendix EC80ESP+ Integrated TPMS
  • Bendix EC80ESP 6S/6M
  • Bendix EC80ESP PLC
  • Bendix EC80ESP 2nd CAN
  • Bendix EC80ESP CAN Gateway
  • Bendix EC80ESP 4S/4M

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.