Security1 publisher2 min readPublished
Bransys ELD shipped one MQTT credential that reads every active device across a subset of carriers
CISA's advisory for the Android and iOS app describes read access to real-time data for every active device on a shared broker. The fix is an app store update, and a credential already extracted still works until Bransys changes it.
The Watch · Security desk
What happened
- CISA published an ICS advisory for Bransys ELD covering CVE-2026-86520, CVE-2026-86689 and CVE-2026-77960 in the Android app below 11.00.00 and the iOS app below 1.1.54.
- The advisory says successful exploitation could allow unauthorized access to telemetry data and firmware, in a product CISA places in the US Transportation Systems sector.
- Three findings are listed: hardcoded MQTT credentials, cleartext transmission of sensitive information, and hardcoded FTP credentials that let an attacker connect to the server and read data.
- Bransys tells users to update through the app store, to Android 11.00.00 or newer and iOS 1.1.54 or newer, and CISA lists that update as the vendor fix.
- Jaime Lightfoot reported the vulnerabilities to CISA, which says no known public exploitation specifically targeting them has been reported to it.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A carrier can update every driver's phone and still be readable by anyone who kept the credential from an older build, because the data it unlocks sits on a broker the carrier does not operate.
- constraint Updating the client is the only control a carrier holds here; the network isolation measures in the advisory belong to whoever runs the broker.
- decision Fleets on the affected broker have to decide whether to treat their past telemetry as already read, because only the broker operator can say which clients subscribed.
MQTT brokers hand out data by subscription. A client authenticates, subscribes to a topic, and receives whatever is published to it. Scoping is the broker's job, and on this broker it did not separate one customer from the next. The product "is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker," CISA wrote [3].
Hardcoded means every copy of that build carries the same secret, and the build is distributed through the app stores [3][6][3]. The attack is just logging in. A valid credential and a route to the broker are enough, and the subscriber looks like any other client [3]. The same class of mistake appears twice in the one advisory, in the MQTT path and in the FTP path [1].
CISA's description of the cleartext finding is that the product "is susceptible to cleartext transmission of sensitive information, which could allow an attacker to connect to the broker and read all data" [4]. The cleartext finding gives a second route to the same feed.
The remedy is cheap and versioned [6], and it ends at the client. CISA describes the app store update as the vendor fix and does not say whether the broker credential was changed; until it is, a credential pulled from an older build still authenticates [2].
CISA's recommended defensive measures are its standard control systems set: keep devices off the internet, put them behind firewalls and away from business networks, use a VPN where remote access is required [10]. The affected endpoints are Android handsets and iPhones running an app over mobile networks to a vendor broker [2]. A carrier does not firewall that path. The access described is read access, so nothing on the vehicle changes, and the record of which clients subscribed sits with whoever operates the broker [4].
What to watch
- Whether Bransys states that the broker credential was rotated and that subscriber records were reviewed.
- Any revision of the advisory that maps each of the three CVEs to a specific finding or adds severity metrics.
- Any CISA update replacing the current line that no known public exploitation has been reported.