Truck-to-truck worm could infect – and disrupt – entire US commercial fleet

Researchers at Colorado State University disclosed that many Electronic Logging Devices (ELDs) mandated in US trucks have insecure defaults (exposed OTA APIs, enabled Wi‑Fi/Bluetooth with weak/predictable credentials) allowing attackers within wireless range to connect, send arbitrary CAN messages, re-flash firmware, and deploy a self-propagating truck-to-truck worm; the team demonstrated a 14‑second drive-by compromise and warned of potential large-scale disruption to commercial fleets while coordinating disclosure with vendors and CISA.