Hardcoded MQTT Credentials in Bransys ELD Affecting Real-time Data Access
CVE-2026-86520
8.7HIGH
What is CVE-2026-86520?
The Bransys ELD product has been identified to have a vulnerability due to the presence of hardcoded MQTT credentials. This flaw permits unauthorized users to gain read access to real-time data from all active devices connected to the compromised MQTT broker across multiple carriers. As a result, sensitive information can be exposed, highlighting the necessity for improved security practices such as the use of dynamic authorization mechanisms and regular credential management.
Affected Version(s)
ELD Android 0 < 11.00.00
ELD iOS 0 < 1.1.54
ELD Android 11.00.00
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jaime Lightfoot reported this vulnerability to CISA