Vulnerability in Bendix EC80 Brake ECU Exposing Hard-Coded Credentials
CVE-2026-71396
5.3MEDIUM
What is CVE-2026-71396?
The Bendix EC80 Brake ECU is vulnerable due to the presence of hard-coded credentials. This flaw potentially allows unauthorized access, enabling attackers to disable automatic traction control. Such a vulnerability compromises vehicle safety, emphasizing the critical need for secure configuration and credential management in embedded systems.
Affected Version(s)
EC80ESP 2nd CAN Z266494
EC80ESP 4S/4M Z286098
EC80ESP 6S/6M Z266494
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ben Gardiner of NMFTA reported this vulnerability to CISA.