CVE-2026-86689: Cleartext Transmission of Sensitive Information in Bransys ELD

Published Sep 18, 2026

Updated

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Affected Software

1 affected component

Bransys Bransys ELD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bransys ELD (Android) to a version that resolves this vulnerability.
Fixed in 11.00.00
Upgrade
Upgrade Bransys ELD (iOS) to a version that resolves this vulnerability.
Fixed in 1.1.54

Event History

Sep 18, 2026

CVE Published

via MITRE·03:48 PM

Data Sourced

via MITRE·03:48 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who could exploit this issue?

An unauthenticated remote attacker who obtains or uses the hardcoded MQTT credentials could gain read access to real-time data. No user interaction or existing privileges are required, although exploitation is rated as high complexity.

What data exposure is described?

The exposed credentials can grant read access to real-time data from every active device for a subset of carriers connected to the affected MQTT broker. The provided information describes confidentiality impact only; it does not indicate integrity or availability impact.