A federal recall moved new firmware into hundreds of thousands of heavy-truck brake controllers. The paperwork described signal-processing trouble that could knock anti-lock braking, traction control, stability control, cruise control, and collision mitigation offline. Fresh reverse engineering presented at Black Hat USA 2026 found another payload inside the same update: removed memory-corruption handlers, denial-of-service paths, a hardcoded credential, and a verified route to remote code execution.
The repair campaign worked as a security patch channel. Nobody named it that way for the fleets operating the trucks.
Bendix filed recall 24E-086 with the National Highway Traffic Safety Administration in October 2024. Its report covered 445,208 EC80 electronic control units and estimated that every unit in the population contained the defect. The remedy was software reprogramming coordinated through vehicle manufacturers. The report did not assign a CVE, describe an attack path, or tell security teams that the patched code could be reached through a network with a known wireless entry point.
one firmware image, two institutional identities
The EC80 controls anti-lock braking and related stability functions on commercial trucks. It also receives J2497, commonly called PLC4TRUCKS, over the electrical connection between tractor and trailer. That network exists mainly to carry trailer ABS status to the cab. Optional tracking hardware and multi-trailer configurations can change its electrical conditions. Earlier NMFTA research demonstrated that J2497 traffic can also be injected wirelessly.
Bendix’s recall described a defect triggered by high electrical noise and low signal strength. Under those conditions, the controller could process certain messages incorrectly, set faults, stop operating, or malfunction. NHTSA’s record warns that related systems may fail and that an incorrect response during a stability event or automated braking request could increase crash risk.
That account justified a safety recall. It did not capture the security properties later found in the firmware diff.
NMFTA researcher Ben Gardiner acquired pre-update and post-update firmware from three EC80 variants used by the affected manufacturers. His Black Hat paper documents functions removed by the remedy, then traces several inputs through those deleted handlers. The work found buffer-handling flaws capable of crashing the controller, a path to code execution through PID 0xC2, and a hardcoded credential associated with disabling traction control. The patch therefore changed both accidental-failure behavior and attacker-controlled behavior.
The distinction affects operations. A maintenance manager sees a recall campaign, schedules dealer work, and tracks completion by vehicle identification number. A security team sees vulnerable components, reachable interfaces, exploit preconditions, mitigations, detection opportunities, and patch urgency. One update can satisfy both systems, but each system needs its own metadata.
the road test made the classification problem physical
NMFTA tested controller failures on a bench and in controlled low-speed runs. SecurityWeek reports that researchers injected signals through a diagnostic port with software-defined radio equipment to simulate the wireless route. Once the crash was triggered, CAN traffic stopped. The observed effects included loss of speedometer, steering assist, shifting, and ABS pulsing. Recovery consistently required disconnecting the battery; one test also required a dealer tool.
Those results do not prove that an attacker can seize steering or directly crash a truck. They establish a remotely reachable path to disabling a controller whose outputs sit inside the vehicle’s braking and stability system. Context decides whether that becomes immobilization, degraded handling, a cargo-theft aid, or an ugly warning-light event. The uncertainty increases the need for accurate disclosure because operators must map the finding onto their own trailers, telematics equipment, routes, maintenance windows, and recall status.
A recall completion percentage cannot do that work alone. SecurityWeek reported NHTSA tracker entries associated with the campaign ranging from zero to 99 percent complete on July 16. A mixed fleet can contain corrected units, uncorrected units, sold equipment, incomplete records, and controllers whose firmware identity is difficult to query centrally. Without a security identifier, those gaps remain detached from vulnerability inventories and threat-intelligence feeds.
disclosure is part of the patch
CVE identifiers are imperfect. They flatten context, invite severity-score theatre, and often arrive late. They still provide a durable join key between manufacturers, fleet software, vulnerability scanners, insurers, regulators, maintenance providers, and incident responders. Gardiner’s paper notes that the fixed flaws received no distinct CVEs and points to coordinated-disclosure guidance that recommends telling users when vulnerabilities have been corrected.
The omission has practical consequences. A fleet defender searching its vulnerability platform for EC80 receives no obvious record connecting J2497 reachability to recall 24E-086. A maintenance provider may know that firmware ID 9363 belongs in the service bay while a security analyst watches wireless and telematics exposure from another console. An incident investigator who sees unusual CAN loss has no public advisory tying the symptom to deleted handlers in older firmware.
The fix also removed functions rather than merely adjusting one length check. That makes version communication especially valuable. Operators need to know which controller families carried which handlers, what the remedy removed, which paths remain reachable, and whether later releases preserve the security boundary. A recall number answers which equipment entered the campaign. A vulnerability record answers why hostile input changes the risk calculation.
recalls already form a national patch network
Vehicle recalls possess machinery that software security often lacks: mandatory manufacturer filings, owner notification, dealer labor, remedy tracking, VIN-level scope, and federal reporting. That is a powerful distribution system for embedded updates. Commercial vehicles make the system harder because equipment changes hands, controllers move through service networks, and uptime pressure stretches maintenance schedules. Even so, the recall channel can reach physical assets that will never run an endpoint agent or appear in a normal software bill of materials.
The EC80 case exposes the price of keeping safety and security vocabularies apart. Regulators receive defect descriptions. Dealers receive service procedures. Owners receive recall notices. Security teams need the attack surface, affected firmware, adversarial consequence, compensating controls, and machine-readable identity. Sending each audience a truthful view of the same patch would strengthen the campaign without turning every mechanical defect into cyber panic.
Manufacturers should dual-file when a safety remedy closes attacker-controlled paths. NHTSA recall records should link to security advisories. CVE records should link back to recall populations and remedy identifiers. Fleet systems should be able to reconcile VIN, ECU part number, firmware ID, recall completion, and vulnerability state in one query. The data already exists in fragments. The missing piece is institutional willingness to admit that a brake-controller update can be a safety remedy and a security patch at the same time.
Bendix got corrected software into the field. NMFTA later supplied the threat model. The next recall should not require a 179-page reverse-engineering paper to tell operators what their patch already fixed.