CVE-2026-67560 (GCVE-0-2026-67560)

Vulnerability from cvelistv5 – Published: 2026-08-27 20:54 – Updated: 2026-08-28 14:13
VLAI
Title
Stack-based Buffer Overflow in Bendix EC80 Brake ECU
Summary
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.7 (High)
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 13:50 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Bendix EC80ESP+ J1708 Affected: Z228999
Unaffected: Z300822
guessed Create a notification for this product.
Bendix EC80ESP+ 6S/6M Affected: Z228999
Unaffected: Z300822
guessed Create a notification for this product.
Bendix EC80ESP+ PLC Affected: Z228999
Unaffected: Z300822
guessed Create a notification for this product.
Bendix EC80ESP+ 2nd CAN Affected: Z228999
Unaffected: Z300822
guessed Create a notification for this product.
Bendix EC80ESP+ Integrated TPMS Affected: Z228999
Unaffected: Z300822
guessed Create a notification for this product.
Bendix EC80ESP 6S/6M Affected: Z266494
Unaffected: Z302578
guessed Create a notification for this product.
Bendix EC80ESP PLC Affected: Z266494
Unaffected: Z302578
guessed Create a notification for this product.
Bendix EC80ESP 2nd CAN Affected: Z266494
Unaffected: Z302578
guessed Create a notification for this product.
Bendix EC80ESP CAN Gateway Affected: Z266494
Unaffected: Z302578
guessed Create a notification for this product.
Bendix EC80ESP 4S/4M Affected: Z286098
Unaffected: Z302579
guessed Create a notification for this product.
Bendix EC80ESP PLC Affected: Z286098
Unaffected: Z302579
guessed Create a notification for this product.
Date Public
2026-08-25 14:28
Credits
Ben Gardiner of NMFTA reported this vulnerability to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67560",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T13:50:27.752340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T14:13:53.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP+ J1708",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z228999"
            },
            {
              "status": "unaffected",
              "version": "Z300822"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP+ 6S/6M",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z228999"
            },
            {
              "status": "unaffected",
              "version": "Z300822"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP+ PLC",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z228999"
            },
            {
              "status": "unaffected",
              "version": "Z300822"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP+ 2nd CAN",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z228999"
            },
            {
              "status": "unaffected",
              "version": "Z300822"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP+ Integrated TPMS",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z228999"
            },
            {
              "status": "unaffected",
              "version": "Z300822"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP 6S/6M",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z266494"
            },
            {
              "status": "unaffected",
              "version": "Z302578"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP PLC",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z266494"
            },
            {
              "status": "unaffected",
              "version": "Z302578"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP 2nd CAN",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z266494"
            },
            {
              "status": "unaffected",
              "version": "Z302578"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP CAN Gateway",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z266494"
            },
            {
              "status": "unaffected",
              "version": "Z302578"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP 4S/4M",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z286098"
            },
            {
              "status": "unaffected",
              "version": "Z302579"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EC80ESP PLC",
          "vendor": "Bendix",
          "versions": [
            {
              "status": "affected",
              "version": "Z286098"
            },
            {
              "status": "unaffected",
              "version": "Z302579"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ben Gardiner of NMFTA reported this vulnerability to CISA."
        }
      ],
      "datePublic": "2026-08-25T14:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Bendix EC80 Brake ECU\n is vulnerable to a stack-based buffer overflow, which may allow an \nattacker to crash the ECU. A crafted payload can then be used to \nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \nThis could cause the loss of the ABS function, steering assist, \nspeedometer, and shifting."
            }
          ],
          "value": "Bendix EC80 Brake ECU\n is vulnerable to a stack-based buffer overflow, which may allow an \nattacker to crash the ECU. A crafted payload can then be used to \nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \nThis could cause the loss of the ABS function, steering assist, \nspeedometer, and shifting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:54:20.022Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEC80ESP+ J1708: Users should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 6S/6M:\u0026nbsp;Users\n\n\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ PLC:\u0026nbsp;Users\u0026nbsp;\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 2nd CAN:\nUsers\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ Integrated TPMS:\u0026nbsp;Users\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP 6S/6M:\nUsers\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 2nd CAN:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP CAN Gateway:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 4S/4M:\nUsers\n\nshould update their firmware to version Z302579.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302579.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
            }
          ],
          "value": "Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.  *  EC80ESP+ J1708: Users should update their firmware to version Z300822.\n  *  EC80ESP+ 6S/6M:\u00a0Users\n\n\u00a0should update their firmware to version Z300822.\n  *  EC80ESP+ PLC:\u00a0Users\u00a0\u00a0should update their firmware to version Z300822.\n  *  EC80ESP+ 2nd CAN:\nUsers\u00a0should update their firmware to version Z300822.\n  *  EC80ESP+ Integrated TPMS:\u00a0Users\u00a0should update their firmware to version Z300822.\n  *  EC80ESP 6S/6M:\nUsers\nshould update their firmware to version Z302578.\n  *  EC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302578.\n  *  EC80ESP 2nd CAN:\nUsers\n\nshould update their firmware to version Z302578.\n  *  EC80ESP CAN Gateway:\nUsers\n\nshould update their firmware to version Z302578.\n  *  EC80ESP 4S/4M:\nUsers\n\nshould update their firmware to version Z302579.\n  *  EC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302579."
        }
      ],
      "source": {
        "advisory": "ICSA-26-237-05",
        "discovery": "EXTERNAL"
      },
      "title": "Stack-based Buffer Overflow in Bendix EC80 Brake ECU",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2026-67560",
    "datePublished": "2026-08-27T20:54:20.022Z",
    "dateReserved": "2026-08-10T16:03:40.493Z",
    "dateUpdated": "2026-08-28T14:13:53.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-67560",
      "date": "2026-08-28",
      "epss": "0.00334",
      "percentile": "0.259"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-67560\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2026-08-28T00:18:08.150\",\"lastModified\":\"2026-08-28T16:18:21.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bendix EC80 Brake ECU\\n is vulnerable to a stack-based buffer overflow, which may allow an \\nattacker to crash the ECU. A crafted payload can then be used to \\nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \\nThis could cause the loss of the ABS function, steering assist, \\nspeedometer, and shifting.\"}],\"affected\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"affectedData\":[{\"vendor\":\"Bendix\",\"product\":\"EC80ESP+ J1708\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z228999\",\"status\":\"affected\"},{\"version\":\"Z300822\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP+ 6S/6M\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z228999\",\"status\":\"affected\"},{\"version\":\"Z300822\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP+ PLC\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z228999\",\"status\":\"affected\"},{\"version\":\"Z300822\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP+ 2nd CAN\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z228999\",\"status\":\"affected\"},{\"version\":\"Z300822\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP+ Integrated TPMS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z228999\",\"status\":\"affected\"},{\"version\":\"Z300822\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP 6S/6M\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z266494\",\"status\":\"affected\"},{\"version\":\"Z302578\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP PLC\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z266494\",\"status\":\"affected\"},{\"version\":\"Z302578\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP 2nd CAN\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z266494\",\"status\":\"affected\"},{\"version\":\"Z302578\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP CAN Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z266494\",\"status\":\"affected\"},{\"version\":\"Z302578\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP 4S/4M\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z286098\",\"status\":\"affected\"},{\"version\":\"Z302579\",\"status\":\"unaffected\"}]},{\"vendor\":\"Bendix\",\"product\":\"EC80ESP PLC\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Z286098\",\"status\":\"affected\"},{\"version\":\"Z302579\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-28T13:50:27.752340Z\",\"id\":\"CVE-2026-67560\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"}]}],\"references\":[{\"url\":\"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-67560\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-28T13:50:27.752340Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-28T14:06:07.043Z\"}}], \"cna\": {\"title\": \"Stack-based Buffer Overflow in Bendix EC80 Brake ECU\", \"source\": {\"advisory\": \"ICSA-26-237-05\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Ben Gardiner of NMFTA reported this vulnerability to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Bendix\", \"product\": \"EC80ESP+ J1708\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z228999\"}, {\"status\": \"unaffected\", \"version\": \"Z300822\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP+ 6S/6M\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z228999\"}, {\"status\": \"unaffected\", \"version\": \"Z300822\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP+ PLC\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z228999\"}, {\"status\": \"unaffected\", \"version\": \"Z300822\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP+ 2nd CAN\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z228999\"}, {\"status\": \"unaffected\", \"version\": \"Z300822\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP+ Integrated TPMS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z228999\"}, {\"status\": \"unaffected\", \"version\": \"Z300822\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP 6S/6M\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z266494\"}, {\"status\": \"unaffected\", \"version\": \"Z302578\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP PLC\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z266494\"}, {\"status\": \"unaffected\", \"version\": \"Z302578\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP 2nd CAN\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z266494\"}, {\"status\": \"unaffected\", \"version\": \"Z302578\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP CAN Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z266494\"}, {\"status\": \"unaffected\", \"version\": \"Z302578\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP 4S/4M\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z286098\"}, {\"status\": \"unaffected\", \"version\": \"Z302579\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Bendix\", \"product\": \"EC80ESP PLC\", \"versions\": [{\"status\": \"affected\", \"version\": \"Z286098\"}, {\"status\": \"unaffected\", \"version\": \"Z302579\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.  *  EC80ESP+ J1708: Users should update their firmware to version Z300822.\\n  *  EC80ESP+ 6S/6M:\\u00a0Users\\n\\n\\u00a0should update their firmware to version Z300822.\\n  *  EC80ESP+ PLC:\\u00a0Users\\u00a0\\u00a0should update their firmware to version Z300822.\\n  *  EC80ESP+ 2nd CAN:\\nUsers\\u00a0should update their firmware to version Z300822.\\n  *  EC80ESP+ Integrated TPMS:\\u00a0Users\\u00a0should update their firmware to version Z300822.\\n  *  EC80ESP 6S/6M:\\nUsers\\nshould update their firmware to version Z302578.\\n  *  EC80ESP PLC:\\nUsers\\n\\nshould update their firmware to version Z302578.\\n  *  EC80ESP 2nd CAN:\\nUsers\\n\\nshould update their firmware to version Z302578.\\n  *  EC80ESP CAN Gateway:\\nUsers\\n\\nshould update their firmware to version Z302578.\\n  *  EC80ESP 4S/4M:\\nUsers\\n\\nshould update their firmware to version Z302579.\\n  *  EC80ESP PLC:\\nUsers\\n\\nshould update their firmware to version Z302579.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEC80ESP+ J1708: Users should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 6S/6M:\u0026nbsp;Users\\n\\n\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ PLC:\u0026nbsp;Users\u0026nbsp;\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 2nd CAN:\\nUsers\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ Integrated TPMS:\u0026nbsp;Users\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP 6S/6M:\\nUsers\\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\\nUsers\\n\\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 2nd CAN:\\nUsers\\n\\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP CAN Gateway:\\nUsers\\n\\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 4S/4M:\\nUsers\\n\\nshould update their firmware to version Z302579.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\\nUsers\\n\\nshould update their firmware to version Z302579.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-08-25T14:28:00.000Z\", \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05\"}, {\"url\": \"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Bendix EC80 Brake ECU\\n is vulnerable to a stack-based buffer overflow, which may allow an \\nattacker to crash the ECU. A crafted payload can then be used to \\nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \\nThis could cause the loss of the ABS function, steering assist, \\nspeedometer, and shifting.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Bendix EC80 Brake ECU\\n is vulnerable to a stack-based buffer overflow, which may allow an \\nattacker to crash the ECU. A crafted payload can then be used to \\nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \\nThis could cause the loss of the ABS function, steering assist, \\nspeedometer, and shifting.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2026-08-27T20:54:20.022Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-67560\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-28T14:13:53.473Z\", \"dateReserved\": \"2026-08-10T16:03:40.493Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2026-08-27T20:54:20.022Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.