CVE-2026-77960

Bransys ELD (Electronic Logging Device) units ship with hardcoded MQTT credentials (CWE-798) baked into the product. Because these credentials are static and shared, an attacker who obtains them can authenticate to the affected MQTT broker over the network with no privileges or user interaction, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Successful abuse grants read access to real-time telemetry data for every active device belonging to the subset of carriers connected to that broker, exposing fleet location and operational data. The impact is limited to confidentiality (VC:L, no integrity or availability impact per the CVSS score of 6.9 medium). No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not listed in CISA KEV, though it was assigned by CISA ICS-CERT.

What to do: Contact Bransys for patched firmware or updated credentials and apply them as soon as a fix is released. Fleets should verify whether their devices connect to the affected MQTT broker, rotate any hardcoded/shared MQTT credentials, and enable per-device authentication where supported. Review broker connection and read logs for unrecognized clients, and restrict broker network access to known device ranges.