He dug deeper. A new module exposed a debugging endpoint—meant for development—left enabled by default in the release. Developers had tucked it in to allow live inspection of message frames and calibration state. When activated, it exposed a simple JSON RPC server on localhost. The documentation mentioned it as "local only." Tobias ran a port scan and confirmed it bound to 127.0.0.1, but he also found a conditional toggle that let users bind it to external interfaces for remote teams. In typical local deployments that toggle would be off, and most users would never touch it. But in tutorials and community guides, someone had shown how to share that endpoint to speed debugging across a Wi‑Fi network at a track day. A feature meant to ease collaboration could become an attack vector.
– The development team behind ECUTools is proud to announce the immediate availability of version 1.59. This update focuses on stability, expanded vehicle support, and highly requested features for professional tuners and automotive diagnosticians. ecutools v1.59
Check power supply – BDM needs 12V external or stable ECU supply. Also, verify the pinout – many cables swap BDM pin 1 and 14. He dug deeper
The software helps identify faulty sensors or electronic components that a standard OBDII scanner might miss. It can also be used to reset adaptation values after replacing mechanical parts. Immobilizer and DPFS Services When activated, it exposed a simple JSON RPC
Integrated basic OBD2 logging for: