Ben Gardiner

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU.

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

**Name of the Vulnerable Software and Affected Versions** ZF Roll Stability Support Plus (RSSPlus) (affected versions not specified) **Description** The issue is related to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds. This may allow an attacker to remotely call diagnostic functions intended for workshop or repair scenarios, potentially impacting system availability and degrading performance or erasing software. However, the vehicle remains in a safe state. The attack can be performed remotely with RF equipment or via a pivot from J2497 telematics devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Power Line Communications PLC4TRUCKS J2497 trailer brake controllers (affected versions not specified) **Description** The issue concerns the lack of authentication or authorization for diagnostic functions in the Power Line Communications PLC4TRUCKS J2497 trailer brake controllers. These functions can be invoked by replaying J2497 messages, potentially allowing unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PLC4TRUCKS J2497 trailer receivers (affected versions not specified) **Description** The issue concerns Power Line Communications PLC4TRUCKS J2497 trailer receivers, which are susceptible to remote RF induced signals. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.