CVE-2026-86689

Bransys ELD devices ship with hardcoded MQTT credentials, so an attacker who obtains these embedded credentials can authenticate to the affected MQTT broker over the network with no privileges and no user interaction. Because the credentials are shared rather than unique per customer, one set of credentials grants read access to real-time data from every active device belonging to the subset of carriers connected to the affected broker, potentially revealing vehicle locations and other live telemetry. The high attack complexity and 'attack requirements present' values in the CVSS 4.0 vector indicate the vulnerable condition (devices actively connected to the affected broker) must be in place for access to succeed. Any carrier or fleet operator whose Bransys ELDs connect to the affected MQTT broker is affected; the available data does not specify affected firmware or product versions. No public proof-of-concept is known, the flaw is not in CISA KEV, and no confirmed in-the-wild exploitation has been reported.

What to do: Apply Bransys's firmware update that removes or rotates the embedded MQTT credentials as soon as it is available (no fixed version is specified in the data). Carriers should confirm with Bransys whether their fleet was connected to the affected MQTT broker, verify broker access-control lists and rotate shared credentials, and review broker logs for unauthorized subscribers. Since the exposure is read-only, treat real-time telemetry (e.g., vehicle positions) for the affected period as potentially disclosed.