Buffer overflow in Bendix Ec80esp 2nd Can
CVE-2026-67560
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (24.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Bendix Ec80esp 2nd Can — versions Z266494
- Bendix Ec80esp+ 2nd Can — versions Z228999
- Bendix Ec80esp 4s/4m — versions Z286098
- Bendix Ec80esp 6s/6m — versions Z266494
- Bendix Ec80esp+ 6s/6m — versions Z228999
- Bendix Ec80esp Can Gateway — versions Z266494
- Bendix Ec80esp+ Integrated Tpms — versions Z228999
- Bendix Ec80esp+ J1708 — versions Z228999
- Bendix Ec80esp Plc — versions Z266494, Z286098
- Bendix Ec80esp+ Plc — versions Z228999
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-67560?
- CVE-2026-67560 is a high-severity vulnerability in Bendix Ec80esp 2nd Can, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2026-08-28.
- How severe is CVE-2026-67560?
- High severity. CVSS v3 base score is 7.5 out of 10.