You can inject CAN bus commands if you can sniff what they're sending. No firmware modification necessary. Not saying it's a good idea to do so, but it is possible to do so.