Bransys ELD
CISA reports Bransys ELD apps ship hardcoded MQTT and FTP credentials plus cleartext transport, exposing real-time telemetry for connected fleet devices.
CISA's advisory covers three Bransys ELD mobile app flaws: CVE-2026-86520 hardcoded MQTT credentials (CVSS 7.5), CVE-2026-86689 cleartext transmission of sensitive information, and CVE-2026-77960 hardcoded FTP credentials. Exploitation could allow unauthorized reading of real-time telemetry data from every active device connected to affected brokers across a subset of carriers. Android versions below 11.00.00 and iOS versions below 1.1.54 are affected; no public exploitation has been reported to CISA.
- Hardcoded MQTT credentials expose real-time telemetry for all devices on carrier brokers
- CVE-2026-86689 allows cleartext data interception by anyone connecting to the broker
- Hardcoded FTP credentials (CVE-2026-77960) permit reading data on the server
- Android below 11.00.00 and iOS below 1.1.54 are affected
- Products
- Bransys ELD
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86520+2 related CVEs | Hardcoded MQTT Credentials Expose Real-Time Telemetry in Bransys ELD | 8.7 group max | — |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. The following versions of Bransys ELD are affected: Android <11. 00.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.