Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix

Bendix quietly patched remote code execution and denial-of-service vulnerabilities in its EC80 heavy-truck brake controller under the guise of a safety recall, without assigning CVE identifiers or publicly disclosing the security fixes. This practice of 'silent patching' is particularly dangerous in critical infrastructure contexts because fleet operators and security teams cannot properly assess risk, prioritize remediation, or monitor for active exploitation. The lack of CVE assignment further undermines the broader security community's ability to track and respond to these vulnerabilities. When safety-critical systems like vehicle brake controllers carry unacknowledged security flaws, the potential consequences extend beyond data breaches to physical harm and loss of life.