CVE-2026-67560

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-28 00:18

Updated : 2026-09-03 18:09

NVD link : CVE-2026-67560

Mitre link : CVE-2026-67560

CVE.ORG link : CVE-2026-67560

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-67560", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67560", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-28T13:50:27.752340Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Bendix", "product": "EC80ESP+ J1708", "versions": [{"status": "affected", "version": "Z228999"}, {"status": "unaffected", "version": "Z300822"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP+ 6S/6M", "versions": [{"status": "affected", "version": "Z228999"}, {"status": "unaffected", "version": "Z300822"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP+ PLC", "versions": [{"status": "affected", "version": "Z228999"}, {"status": "unaffected", "version": "Z300822"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP+ 2nd CAN", "versions": [{"status": "affected", "version": "Z228999"}, {"status": "unaffected", "version": "Z300822"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP+ Integrated TPMS", "versions": [{"status": "affected", "version": "Z228999"}, {"status": "unaffected", "version": "Z300822"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP 6S/6M", "versions": [{"status": "affected", "version": "Z266494"}, {"status": "unaffected", "version": "Z302578"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP PLC", "versions": [{"status": "affected", "version": "Z266494"}, {"status": "unaffected", "version": "Z302578"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP 2nd CAN", "versions": [{"status": "affected", "version": "Z266494"}, {"status": "unaffected", "version": "Z302578"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP CAN Gateway", "versions": [{"status": "affected", "version": "Z266494"}, {"status": "unaffected", "version": "Z302578"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP 4S/4M", "versions": [{"status": "affected", "version": "Z286098"}, {"status": "unaffected", "version": "Z302579"}], "defaultStatus": "unaffected"}, {"vendor": "Bendix", "product": "EC80ESP PLC", "versions": [{"status": "affected", "version": "Z286098"}, {"status": "unaffected", "version": "Z302579"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-28T00:18:08.150", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Bendix EC80 Brake ECU\n is vulnerable to a stack-based buffer overflow, which may allow an \nattacker to crash the ECU. A crafted payload can then be used to \nremotely execute arbitrary code or inject arbitrary CAN bus traffic. \nThis could cause the loss of the ABS function, steering assist, \nspeedometer, and shifting."}], "lastModified": "2026-09-03T18:09:03.317", "sourceIdentifier": "ics-cert@hq.dhs.gov"}