ELD cybersecurity: What fleet managers need to know about truck hacking risks

Security researchers recently stopped a truck from accelerating. They did it by hacking its ELD. The whole attack took about 30 seconds.

If you run a fleet, this isn't theoretical anymore. The same devices that keep you DOT-compliant are creating security gaps that most operators don't even know exist. And unlike a data breach at your office, a compromised ELD could physically disable your trucks. Or put drivers at risk.

This post breaks down what the researchers found, why it matters for your operations, and five things you can do this week to reduce your exposure.

What the Colorado State researchers actually discovered

Here's the backstory. In early 2024, a team at Colorado State University bought an ELD off a popular e-commerce site and took it apart. Associate Professor Jeremy Daily led the research.

What they found should make every fleet operator uncomfortable.

The device had a Wi-Fi connection that wasn't documented anywhere. Not in the user manual. Not in the reseller documentation. Nothing. And the password protecting that connection? Weak and predictable. A default that hadn't been changed.

Once the researchers connected, they had access to the truck's Controller Area Network. That's the internal system that controls everything from acceleration to braking to sensor data. They could send arbitrary messages to the truck's systems. They could upload malicious firmware directly to the ELD.

Then they demonstrated it. On a 2014 Kenworth T270.

They uploaded firmware that blocked acceleration commands. The driver floored the pedal. The truck sat there. Thirty seconds from first connection to full control.

Here's the part that should keep you up at night: the attack only required being close enough for a Wi-Fi signal. Think about how many times your trucks park next to other trucks at fuel stops, distribution centers, or rest areas.

The team also modeled what they called a "truck-to-truck worm." They showed how one infected vehicle could spread malware to nearby trucks with the same vulnerabilities. Picture a company yard where 40 trucks sit overnight. One gets compromised. By morning, all 40 could be infected.

Why this problem is bigger than one bad device

You might be thinking: okay, one ELD had security issues. That's the vendor's problem.

It's not that simple.

When the researchers examined devices from multiple vendors, they found something troubling. Many ELDs share nearly identical architectures. Some devices from different brands are essentially clones with different logos. A vulnerability in one likely exists in others.

ELDs aren't optional for most carriers. The mandate took effect December 18, 2017. Full compliance was required by December 16, 2019. The U.S. has over 14 million registered medium and heavy-duty trucks. Most HOS-regulated operations must use these devices.

That's a lot of connected vehicles. And those vehicles all have devices that bridge the truck's internal network to the outside world.

Urban Jonson, Senior VP of IT and Cybersecurity at Serjon (a firm that specializes in fleet transportation security), puts it bluntly. The real risk isn't someone stealing your data. It's someone sending malicious CAN messages that disable your vehicles entirely.

What this actually looks like for your business

Let's get specific about the risks.

Ransomware. Someone disables your fleet and demands payment. You're choosing between writing a check or watching revenue disappear while you figure out what happened. There's no workaround. You can't just disconnect the ELD and keep running because you need it for compliance.

Operational disruption during critical windows. Your trucks lock up on the busiest day of the quarter. Deadlines get missed. Customers lose trust. Penalties pile up. One fleet manager I spoke with said a single day of downtime costs them $12,000 per truck in lost revenue and penalties.

Targeted cargo theft. An attacker uses the ELD to track a high-value load. They know exactly where it is, where it's going, and when the driver stops. They act on that information.

Safety incidents. Bogus sensor data gets sent to vehicle systems. A driver thinks everything is fine when it isn't. Now you've got liability exposure on top of everything else.

The ransomware scenario is particularly ugly. It exploits the same federally mandated devices you're required to install. There's no easy escape hatch.

Five things you can do this week

First, find out what's actually connected to your trucks.

This sounds obvious. It's not.

Many fleet operators don't have a complete inventory of the telematics devices on their vehicles. They know about the ELD. But what about the GPS tracker the previous owner installed? The fuel monitoring device someone added three years ago? The cellular module that came with the trailer lease?

Create a list. For every device, document what network access it has, what data it transmits, and whether the credentials have ever been changed. This baseline lets you understand your real exposure and spot anomalies later.

Second, change default passwords. Today.

The Colorado State researchers got initial access through a default password. This feels embarrassingly basic. It also works, which is why attackers use it constantly.

If your ELD devices have configurable credentials, change them now. Not next week. Now. If your devices don't allow credential changes, call your vendor and ask why. Their answer will tell you a lot about their security posture.

Third, start asking your vendors hard questions.

The National Motor Freight Traffic Association developed something called the Telematics Security Requirements Matrix. It's specifically designed to help fleets evaluate vendor security during procurement. Start using it.

Here are the questions that matter:

What security testing do you perform on your devices before they ship? How do you distribute firmware updates, and how quickly? Have you addressed CVE-2024-28878?

That last one is important. CVE-2024-28878 is a flaw identified in the IOSIX IO-1020 Micro ELD that allows code execution without proper origin verification. If your vendor can't speak to specific CVEs, that tells you something about how seriously they take security.

Fourth, build firmware updates into your maintenance schedule.

The researchers noted that the manufacturer was working on a fix. Great. But fixes don't help if they never get installed.

Make firmware version tracking part of your standard maintenance process. When trucks come in for service, check what version they're running. Keep a spreadsheet if you have to. Automated is better, but manual tracking beats no tracking.

Fifth, watch for weird behavior.

If a truck suddenly shows unexpected location data, throws communication errors, or generates strange diagnostic codes, don't ignore it. These could be early signs of compromise.

Some fleet management platforms flag anomalies automatically. If yours does, actually look at the alerts. If it doesn't, build in regular spot-checks. Even 15 minutes a week looking for patterns is better than nothing.

What the industry is doing (and where the gaps are)

The 2026 NMFTA Transportation Industry Cybersecurity Trends Report names telematics devices as a continuing threat vector. The report notes that while telematics have become indispensable to modern fleet operations, their remote connectivity creates opportunities for wireless attacks on tractors and trailers.

Here's the gap: FMCSA mandates ELD functionality. They rely on self-certification for compliance. There are no hard cybersecurity requirements. Standards are driven by industry guidance and voluntary best practices.

That means the responsibility falls on you. Waiting for regulations to catch up isn't a strategy. By the time mandatory cybersecurity standards exist (if they ever do), the threat landscape will have evolved again.

The bottom line

Your trucks are computers on wheels. They need to be secured like any other connected asset in your operation.

The good news? The steps aren't complicated. Inventory your devices. Change default credentials. Ask vendors real questions. Keep firmware current. Watch for anomalies.

None of this requires a dedicated cybersecurity team. It requires attention and discipline. Both are achievable for fleets of any size.

Next steps

The NMFTA offers cybersecurity resources at nmfta.org/cybersecurity. They're designed for fleets of all sizes and can help you assess your current exposure.

If you're looking for a unified platform to manage your safety and compliance data, RaiseDash can help you maintain visibility across your fleet operations.

---

Frequently asked questions

Can hackers really control my trucks through an ELD?

Yes. The Colorado State researchers demonstrated exactly this. They gained wireless access to a truck's CAN network through a commercially available ELD. They prevented acceleration despite the driver flooring the pedal. The attack required Wi-Fi proximity, but the vulnerability is real and affects devices from multiple manufacturers.

Are all ELD brands vulnerable?

Not necessarily all of them. But the research found that many ELDs share similar architectures. Some devices from different brands are essentially clones with different labels. A vulnerability discovered in one device often exists in others. Ask your vendor directly about their security practices and whether they've addressed CVE-2024-28878.

What's the first thing I should do to protect my fleet?

Change default passwords and update firmware. Then create a complete inventory of all telematics devices connected to your trucks. Many fleet operators don't actually know everything that's plugged into their vehicles' networks. You can't secure what you don't know about.

Is FMCSA addressing this?

Not directly. FMCSA mandates ELD functionality but relies on self-certification. Cybersecurity baselines are being driven by industry groups like NMFTA through voluntary standards rather than hard regulatory requirements. Don't wait for regulators. Take action now.

Could one infected truck spread malware to my entire fleet?

The researchers modeled this scenario. They demonstrated how a "truck-to-truck worm" could propagate in locations where vehicles park together. Think truck stops, distribution centers, or your own company yard. While they didn't release a working proof-of-concept on real ELDs, the threat model is concerning enough that you should have monitoring and rapid response capabilities in place.

How do I know if my ELD has been compromised?

Watch for anything unusual: unexpected location data, communication errors, strange diagnostic codes, or vehicles behaving differently than expected. Some fleet management platforms flag anomalies automatically. Regular manual checks are valuable too. If something feels off, investigate. Trust your instincts.