A safety recall issued in late 2024 for heavy commercial trucks from Volvo, International, and Paccar was presented to the public as a fix for memory corruption caused by electrical line noise. A Black Hat USA 2026 presentation by Ben Gardiner of the National Motor Freight Traffic Association (NMFTA) revealed a different picture: the recall simultaneously and silently patched multiple critical cybersecurity vulnerabilities — including one that enabled wireless remote code execution on brake controllers.
The Recall: Bendix EC80 Electronic Control Unit
The recall covered approximately 450,000 units of the Bendix EC80 ECU, the module responsible for anti-lock braking, traction control, and stability functions in heavy commercial vehicles. Bendix officially attributed the problem to memory corruption caused by line noise on the J2497 powerline databus — the standard mandated since 2001 for trailer ABS warning light communication over the vehicle's powerline.
Nothing in the recall documentation mentioned cybersecurity.
What Firmware Analysis Revealed
Gardiner reverse-engineered pre- and post-update firmware from three EC80 units and found the update had silently deleted dozens of functions. Within the removed code, he identified:
- Buffer-handling flaws enabling ECU crashes and arbitrary code execution
- A hardcoded password that could be used to disable traction control
- A code path offering a direct route to both crashing the ECU and executing arbitrary code
The findings were supported by two CISA ICS advisories (ICSA-22-063-01) that had been filed years earlier but received minimal public attention:
- CVE-2022-25922: Lack of authentication and authorization for diagnostic functions on the brake controller
- CVE-2022-26131 (CVSS 9.3 Critical): Susceptibility of trailer PLC receivers to remote RF attacks — NMFTA's report noted this is the first confirmed case of J2497 reception leading to safety impacts
The Wireless RCE Problem
The J2497 protocol, which operates over the vehicle's existing powerline wiring, is wirelessly accessible. An attacker within RF range can transmit arbitrary PLC signals that reach both trailer and tractor brake controllers — no physical access or network intrusion required. CVE-2022-26131 documents exactly this path: wireless signals can trigger the vulnerable code paths in brake ECUs on affected vehicles.
This is not a theoretical attack. The recalled units demonstrated that an ECU crash or code execution could be triggered from outside the vehicle via RF, targeting safety-critical braking systems.
Safety Recall as Security Patch: A Pattern to Watch
The presentation highlights a significant transparency problem in the vehicle safety ecosystem. Manufacturers are required to notify regulators and the public about safety recalls and their causes, but there is no equivalent obligation to disclose that a safety patch also addresses cybersecurity vulnerabilities. The result: critical security fixes can be deployed quietly under the cover of functional safety language.
For fleet operators, this means:
- Security patch status cannot be inferred from recall completion records alone — the same firmware update may close both safety and security gaps
- Legacy equipment remains at risk: the industry is gradually moving away from J2497, but older trailers coupled to newer tractors can still route J2497 signals to vulnerable ECUs
- OT/vehicle security requires active monitoring of CISA ICS advisories, not just standard recall tracking
Industry Implications
Gardiner collaborated with researchers Chris Poore, Dan Salloum, and Eric Thayer of Assured Information Security. Their Black Hat presentation is one of the most detailed public analyses to date of how functional safety and cybersecurity interact — and sometimes collide — in commercial vehicle electronics.
For organizations operating large truck fleets, the immediate step is verifying that all Bendix EC80 units in service have received the updated firmware from the 2024 recall. For the broader industry, the research underscores the need for transparent, dual-classification disclosure when a safety recall also closes a security vulnerability.