CVE-2026-86520

Bransys ELD electronic logging devices are shipped with hardcoded MQTT credentials (CWE-798), meaning the same embedded username and password is present across deployed units. An attacker who obtains these credentials can authenticate to the affected MQTT broker over the network with no privileges or user interaction required. Successful access grants read-only visibility into real-time data from every active device belonging to a subset of carriers connected to that broker; the CVSS 4.0 score of 8.7 (high) reflects high confidentiality impact with no integrity or availability impact. Any carrier fleet running Bransys ELD devices that were connected to the affected broker is affected. No exploitation has been observed, no public proof-of-concept is known, and the issue is not listed in CISA's KEV, though it was assigned by CISA ICS-CERT.

What to do: Contact Bransys support for patched firmware or rotated credentials before deploying any new ELD units, since the hardcoded credentials are baked into shipped devices. Broker-side mitigations include rotating the shared MQTT credentials, enforcing per-device credentials or TLS client certificates with access-control lists, and reviewing broker connection/subscription logs for unknown clients. Because exposure is read-only telemetry, treat historical and in-flight vehicle/location data from the affected period as potentially disclosed to third parties.