Bransys ELD Ships With Hardcoded MQTT and FTP Credentials
Hardcoded credentials in a shipping production app, not a novel threat pattern, just the standard operational-security failure that keeps showing up in transportation telematics.
TL;DR
CISA disclosed three vulnerabilities in the Bransys ELD transportation app affecting Android versions below 11.00.00 and iOS below 1.1.54. The flaws include hardcoded MQTT credentials granting read access to real-time data for every active device across a subset of carriers connected to the affected broker (CVE-2026-86520), cleartext transmission of sensitive information (CVE-2026-86689), and hardcoded FTP credentials (CVE-2026-77960). Bransys recommends updating through the app store. No known public exploitation has been reported to CISA. This is at least the second CISA ELD advisory involving default or hardcoded credentials since April 2024.
CVE-2026-86520 is the most consequential of the three, with a CVSS v3.1 base score of 7.5. The hardcoded MQTT credentials grant read access to real-time data for every active device across a subset of carriers connected to the affected broker. For a fleet operator, that means telemetry data from across the connected device population (not just your own trucks) was reachable by anyone who extracted the credential from the app binary.
CVE-2026-86689 compounds the exposure: cleartext transmission of sensitive information means an attacker who connects to the broker can read the data in transit without additional decryption. CVE-2026-77960 adds a second path with hardcoded FTP credentials that could allow an attacker to connect to the server and read data.
The fix is straightforward, update Android to 11.00.00 or newer, iOS to 1.1.54 or newer through the respective app stores, and CISA reports no known public exploitation at this time. But the advisory doesn't say whether Bransys has disclosed if the credentials were compromised before the patch, or how long the patched versions have been available.
This isn't the first time CISA has flagged hardcoded credentials in an ELD. In April 2024, ICSA-24-093-01 covered the IOSIX IO-1020 Micro ELD, which used default Wi-Fi and web-server passwords and allowed adjacent attackers to take control of vehicle systems. The recurrence suggests the transportation-telematics supply chain has a persistent gap between the security expectations that come with critical-infrastructure designation and the operational practices that ship in production firmware. Hardcoded credentials are a solved problem in secure development lifecycles; they keep appearing anyway.
Published ·Deep Fathom