Bransys ELD Flaws Could Reveal Live Fleet Telemetry Through Shared Credentials

Three vulnerabilities in Bransys electronic logging device software could expose live vehicle telemetry, backend data, and potentially firmware to unauthorized users. The weaknesses affect older Android and iOS releases deployed in the United States transportation sector.

CISA published advisory ICSA-26-260-01 on September 17, 2026. It covers two sets of embedded credentials and the inadequate encryption of sensitive communications.

The affected software is:

• Bransys ELD for Android earlier than 11.00.00
• Bransys ELD for iOS earlier than 1.1.54

All three vulnerabilities apply to both platform ranges. Jaime Lightfoot reported the issues to CISA.

Shared MQTT access could expose data from multiple carriers

The most severe issue under CVSS v3.1 is CVE-2026-86520, a case of hard-coded MQTT credentials classified as CWE-798.

MQTT is commonly used to exchange lightweight messages between remote devices and backend services. In this case, credentials embedded in the product may allow an attacker to authenticate to the affected MQTT broker and read real-time information.

The exposure is potentially broader than a single compromised ELD. According to CISA’s description, the credentials could provide visibility into every active device across a subset of carriers connected to the same broker.

That shared-backend dimension materially changes the risk. An attacker who obtains functioning credentials may not need to compromise trucks or mobile devices individually. Instead, broker access could become a centralized path to telemetry generated by multiple active deployments.

CVE-2026-86520 has the following ratings:

• CVSS v3.1: 7.5 High
• CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0: 8.7 High
• CVSS v4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

The vectors describe a remotely reachable weakness with low attack complexity, no required account privileges, and no user interaction. The assessed effect is a serious loss of confidentiality, without claimed impact on data integrity or service availability.

CISA has not disclosed the actual credentials, broker address, exposed message topics, or the precise telemetry fields available to an unauthorized user.

Unencrypted communications create a second broker-level weakness

CVE-2026-86689 concerns sensitive information transmitted without adequate encryption. It is mapped to CWE-319, Cleartext Transmission of Sensitive Information.

An attacker who satisfies the necessary conditions may connect to the broker and read data available through it. This issue therefore complements the credential problem: one vulnerability concerns how access is authenticated, while the other concerns how sensitive information is protected in transit.

Its severity changes considerably between scoring systems:

• CVSS v3.1: 5.9 Medium
• CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0: 8.2 High
• CVSS v4.0 vector: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Both assessments identify potentially high confidentiality loss. CVSS v3.1 treats exploitation as having high complexity, while the CVSS v4.0 vector records a required prior condition through AT:P.

Neither model attributes integrity or availability consequences to the flaw. The published description also does not specify whether the exposed traffic consists of device-to-broker messages, administrative communications, authentication material, or a combination of those elements.

Embedded FTP credentials expose stored backend material

The third vulnerability, CVE-2026-77960, involves hard-coded credentials for an FTP service. Like the MQTT issue, it is categorized under CWE-798.

An attacker could use the embedded credentials to connect to the associated FTP server and read stored information. The advisory’s broader summary mentions unauthorized access to firmware, although it does not identify the precise files, directory structure, or access permissions available through the FTP account.

The flaw received these scores:

• CVSS v3.1: 5.3 Medium
• CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• CVSS v4.0: 6.9 Medium
• CVSS v4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitation is network-based, requires low complexity, and does not depend on privileges or user interaction. Its confidentiality impact is rated lower than the MQTT-related weaknesses.

No ability to upload or alter firmware has been disclosed. Likewise, the vulnerability descriptions do not claim that attackers can change ELD records, control vehicles, interrupt service, or issue commands to devices.

Fleet operators face confidentiality and privacy risks

Bransys ELD is used in transportation environments, where telemetry can carry operationally sensitive information. Unauthorized visibility may affect fleet monitoring, logistics confidentiality, and the privacy of drivers or other individuals represented in the collected data.

The cross-device reach of the MQTT weakness is the central concern. Exposure through a common broker can create consequences at carrier or multi-carrier scale rather than limiting the incident to one mobile application installation.

Still, the documented impact remains focused on data access. There is no published evidence that these CVEs provide a path to modifying records, disrupting fleet operations, or taking control of an ELD.

CISA said it had received no reports of known public exploitation specifically targeting the three vulnerabilities when the advisory was published. No addition to CISA’s Known Exploited Vulnerabilities catalog, KEV remediation deadline, or recent Bransys KEV precedent has been disclosed.

That distinction matters: the weaknesses are remotely exploitable under their scoring assumptions, but the available information does not establish that attackers are actively using them.

Upgrades should be paired with credential and network review

Organizations should move Android installations out of the affected range by deploying Bransys Android 11.00.00 or later, where an appropriate supported release is available. Bransys iOS deployments should similarly be upgraded to 1.1.54 or later.

Because two vulnerabilities involve embedded credentials, upgrading endpoints should not be treated as the only defensive step. Fleet operators should determine whether exposed MQTT or FTP credentials remain valid and whether backend credential rotation is required. Specific rotation instructions or indicators of compromise have not been published.

CISA also recommends that operators:

• Minimize internet exposure for ELD-related backend services and control-system equipment.
• Place operational systems behind firewalls and separate them from corporate networks.
• Use secured remote-access methods, including maintained VPN infrastructure, when remote connectivity is necessary.
• Evaluate operational impact before changing production configurations.
• Apply defense-in-depth controls and the guidance in ICS-TIP-12-146-01B, Targeted Cyber Intrusion Detection and Mitigation Strategies.
• Investigate suspicious activity through established incident-response procedures and report suspected malicious activity to CISA.

Defenders should review MQTT and FTP authentication logs for unexpected source addresses, unusual session volumes, bulk reads, or access inconsistent with normal fleet operations. However, CISA has not published vulnerability-specific indicators, malicious IP addresses, filenames, or broker topics.

Organizations should also inventory every affected Android and iOS deployment. Updating the mobile applications without examining the shared MQTT and FTP infrastructure could leave historical exposure, active credentials, or unauthorized backend sessions undetected.