LAS VEGAS — At the Black Hat USA 2026 conference, cybersecurity researchers peeled back the curtain on a significant industrial security event that had been largely framed as a routine safety matter. Ben Gardiner, a senior cybersecurity research engineer at the National Motor Freight Traffic Association (NMFTA), presented findings revealing that a 2024 safety recall affecting approximately 450,000 heavy-duty trucks was, in fact, a stealthy patch for a suite of severe, exploitable software vulnerabilities.
The recall, which targeted Bendix’s EC80 electronic control unit (ECU)—the "brain" behind anti-lock braking (ABS), traction control, and vehicle stability systems—was publicly attributed to memory corruption caused by signal noise on the vehicle’s communication bus. However, Gardiner’s reverse-engineering of the updated firmware suggests a far more complex reality: the presence of remotely reachable code execution flaws, hardcoded administrative credentials, and critical buffer-handling errors that could have allowed malicious actors to effectively "brick" a vehicle’s primary safety systems.
The Anatomy of the EC80 and the PLC4TRUCKS Vulnerability
The EC80 unit is a critical component in the modern logistics supply chain. It manages the fundamental safety dynamics of heavy commercial vehicles, including heavy-duty tractor-trailers. Central to the operation of these units is the J2497 protocol, commonly referred to as "PLC4TRUCKS."
Introduced in 2001, PLC4TRUCKS serves as the industry-standard powerline databus, facilitating essential communication between the tractor and the trailer. It is the mandatory mechanism required to power and signal the trailer’s ABS warning lights, as mandated by federal safety regulations. Because this protocol operates over the existing power lines of the trailer’s electrical system, it creates a unique attack surface.
As Gardiner explained during his presentation, the EC80’s implementation of this protocol was riddled with weaknesses. By analyzing pre- and post-update firmware from three different Original Equipment Manufacturers (OEMs) that utilize the Bendix system, the NMFTA research team discovered that the "safety update" had quietly purged dozens of functions from the unit’s codebase. These functions were the hosts for multiple critical vulnerabilities, including:
- Remote Code Execution (RCE): Flaws in buffer handling that could have allowed an attacker to inject and execute arbitrary code.
- Hardcoded Credentials: A back-door password that could allow an unauthorized party to disable the truck’s traction control system.
- Denial-of-Service (DoS) Vectors: Paths that could force the ECU into a permanent crash state, requiring a manual hard-reset of the vehicle’s battery to restore functionality.
Chronology of the Discovery and Response
The path to uncovering these vulnerabilities began with the NMFTA’s ongoing efforts to audit the security of the commercial transport sector.
- 2022: The NMFTA publishes research highlighting that the J2497 protocol can be accessed remotely, either through compromised trailer telematics devices or direct injection techniques.
- Late 2024: Three major OEMs issue a massive recall affecting 450,000 units. The official narrative from the manufacturer, Bendix, points to memory corruption issues caused by line noise on the J2497 bus, which could theoretically cause the ECU to go offline.
- Post-2024: The NMFTA begins a deep-dive reverse-engineering project, comparing the "vulnerable" firmware against the "patched" version.
- August 2026: At Black Hat USA, the NMFTA presents the full scope of the security flaws, arguing that the recall was an unacknowledged security patch.
The NMFTA emphasized that they followed responsible disclosure protocols throughout the process, briefing the affected OEMs, the National Highway Traffic Safety Administration (NHTSA), and Transport Canada before taking the information public.
Technical Implications and Real-World Testing
To understand the potential for real-world catastrophe, the NMFTA conducted rigorous testing. In a controlled, closed-track environment, researchers utilized a software-defined radio to inject signals through the truck’s diagnostic port, effectively simulating a remote wireless attack.
The results were concerning. When the attack was initiated while the vehicle was in motion—specifically at speeds below 5 mph and around 9 mph—the impact was immediate and systemic. The controller crash caused all communication on the CAN bus to cease entirely.
The resulting "Denial of Service" state was severe:
- Total Loss of ABS: The anti-lock braking system ceased to pulse, returning the vehicle to a state of manual, non-assisted braking.
- Dashboard Failure: The speedometer and other critical telemetry gauges went dark.
- Mechanical Impairment: The vehicle experienced a loss of steering assist and shifting capabilities.
Critically, the ECU did not automatically recover. The only way to restore the vehicle to a functional state was to physically disconnect and reconnect the vehicle’s battery—a task that is neither safe nor practical while a vehicle is navigating public roadways.
Assessing the Security-Safety Divide
One of the most contentious points raised by the NMFTA is the lack of Common Vulnerabilities and Exposures (CVE) identifiers for these flaws. By categorizing the issue strictly as a safety-related recall, the manufacturers avoided the standard security disclosure process.
"None of the vulnerabilities received a CVE identifier despite being fixed," Gardiner noted. "This may obscure the security significance of what was framed publicly as a safety-only update."
The NMFTA suggests that this approach creates a dangerous "blind spot" in the industry. If vulnerabilities are not cataloged as cybersecurity issues, fleet managers and IT security teams are less likely to prioritize the updates with the same urgency as they would a known "hackable" threat.
The Risk of Cargo Theft and Immobilization
When asked about the potential for these vulnerabilities to be exploited in criminal activities—such as the recent surge in high-value cargo theft—the NMFTA maintained a nuanced view. They acknowledged that while an attacker could theoretically immobilize a truck, the outcome is highly context-dependent.
"Causing a crash directly isn’t clear-cut because the attacks don’t take away the driver’s control of the vehicle," the NMFTA explained. However, the inability to move a vehicle, combined with the loss of driver-assist features, creates a significant operational risk. Drivers are trained to cease operation immediately if critical systems fail, which could be exploited to strand a vehicle in an isolated location, making it a prime target for theft.
The Challenge of Recall Completion
A significant hurdle in this saga is the real-world application of the fix. According to the NHTSA’s public recall-completion tracker as of July 16, 2026, completion rates for the affected units vary wildly—from 0% to 99%.
The NMFTA estimates that industry-wide recall completion typically plateaus at around 80%. This leaves nearly 100,000 trucks potentially still operating on the road with unpatched, vulnerable ECUs. Several factors contribute to this lag:
- Lost/Decommissioned Equipment: Older trucks that are no longer in service but remain in the registry.
- Underreporting: A lack of centralized tracking for fleet repairs.
- Logistical Hurdles: The difficulty of coordinating hundreds of thousands of heavy-duty vehicles for in-person service at dealerships.
Conclusion: A Call for Transparency
The NMFTA’s findings serve as a stark reminder that as heavy-duty transport becomes increasingly digitized, the distinction between "safety" and "security" is disappearing. The EC80 incident demonstrates that firmware updates for industrial components are often, by definition, security updates.
By failing to disclose the existence of exploitable code, the industry may be delaying necessary security postures. The NMFTA has published a comprehensive 179-page technical whitepaper to ensure that the security community, OEM developers, and regulatory bodies have a complete understanding of the risks associated with legacy protocols like J2497.
As of the time of this publication, Bendix has not issued a formal response to the claims made at Black Hat. For the logistics and transportation sector, the message is clear: the era of "security through obscurity" in vehicle hardware has ended, and the industry must now pivot toward rigorous, transparent, and prompt vulnerability management to keep the nation’s supply chain both moving and secure.
