Hardcoded Credentials Vulnerability in Bransys ELD Product
CVE-2026-77960

6.9MEDIUM

Key Information:

Vendor

Bransys

Status
Eld
Vendor
CVE Published:
18 September 2026

What is CVE-2026-77960?

The Bransys ELD product contains hardcoded MQTT credentials that expose real-time data access for all connected devices through a compromised MQTT broker. This security lapse may allow unauthorized individuals to read sensitive information transmitted across affected carriers, thereby compromising the integrity and confidentiality of the data.

Affected Version(s)

ELD Android 0 < 11.00.00

ELD iOS 0 < 1.1.54

ELD Android 11.00.00

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jaime Lightfoot reported this vulnerability to CISA.
.