CVE-2026-77960 - Use of Hard-coded Credentials in Bransys ELD

Back Back to CVE browser

MEDIUM

Use of Hard-coded Credentials in Bransys ELD

Published Sep 18, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.33%

Description

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Affected products

Vendor Bransys Product ELD Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.1.54
- Version
  0
  Status
  affected
  Constraints
  <11.00.00
- Version
  1.1.54
  Status
  unaffected
  Constraints
  -
- Version
  11.00.00
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bransys

ELD

unaffected

Version	Status	Constraints
0	affected	<1.1.54
0	affected	<11.00.00
1.1.54	unaffected	-
11.00.00	unaffected	-

Remediation

Vendor solution

Bransys recommends that users update their system through the app store. Android users should be on version 11.00.00 or newer. iOS users should be on version 1.1.54 or newer.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

Link	Providers	Tags
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01