Bransys ELD Hardcoded Credentials and Cleartext Transmission Vulnerabilities

Technical Analysis

CVE-2026-86520 (CVSS v3.1 7.5) involves hardcoded MQTT broker credentials embedded in the app, granting read access to real-time telemetry for all connected devices across affected carriers. CVE-2026-86689 (CVSS v3.1 5.9) is a cleartext transmission of sensitive information flaw (CWE-319) that allows an attacker with network access to connect to the broker and read all transmitted data. CVE-2026-77960 (CVSS v3.1 5.3) involves hardcoded FTP credentials (CWE-798), enabling attackers to connect to the FTP server and exfiltrate stored data. All three vulnerabilities are remotely exploitable with low attack complexity and no privileges or user interaction required, though CVE-2026-86689 requires high attack complexity. This is a traditional ICS/IoT credential-management and transport-security flaw with no direct AI agent tooling involvement, but any organization using AI agents for fleet telemetry analytics, predictive maintenance, or logistics automation that ingest data from these ELD MQTT/FTP feeds could unknowingly process spoofed or intercepted data, so pipelines consuming this telemetry should validate data integrity.

Affected Systems

Bransys ELD Android application versions prior to 11.00.00; Bransys ELD iOS application versions prior to 1.1.54; associated backend MQTT broker and FTP server infrastructure used for telemetry transmission

Indicators of Compromise

• No specific IOCs published (no known public exploitation reported by CISA at this time)

Remediation Steps

1. 1

   Update Bransys ELD applications

   Update Android devices to version 11.00.00 or later and iOS devices to version 1.1.54 or later via the respective app stores.

2. 2

   Rotate credentials

   Vendor and operators should rotate any hardcoded MQTT and FTP credentials and eliminate hardcoded secrets from future firmware/app builds.

3. 3

   Enforce encrypted transport

   Ensure all telemetry data transmission uses TLS/encrypted channels rather than cleartext protocols.

4. 4

   Network segmentation

   Isolate ELD and fleet telemetry systems from business networks and the public internet, restricting access behind firewalls.

5. 5

   Use secure remote access

   Require VPN or equivalent secure remote access methods when connectivity to these systems is necessary, and keep VPN software updated.

6. 6

   Monitor for anomalous access

   Monitor MQTT broker and FTP server logs for unauthorized connection attempts and report suspicious activity to CISA.