Reversing a Recall

A binary-diff and reverse-engineering analysis of Bendix EC80 firmware and the ID9363 updater shows the recall removed J1587 PID processing on the tractor-side J2497 powerline bus (leaving only LAMP/ABS handling). The removed code contained critical flaws — a stack buffer overflow (PID 0xC2) enabling verified RCE, an unbounded copy (PID 0xED) causing DoS and theoretical RCE, a hardcoded traction-control credential (PID 0xC7), and an OOB write path via SCI2 edge handling — all exploitable via contiguous J2497 frame manipulation or wireless PLC injection; bench and controlled in-motion tests confirmed vehicle impact (loss of ABS, speedometer, steering assist and other systems). The ID9363 patch effectively removes the vulnerable functionality, reducing attack surface for attackers with J2497 adjacency or compromised trailer devices.