CVE-2026-86520: Bransys ELD Information Disclosure Flaw

CVE-2026-86520 Overview

CVE-2026-86520 affects Bransys Electronic Logging Device (ELD) products, which ship with hardcoded Message Queuing Telemetry Transport (MQTT) credentials. An unauthenticated remote attacker who obtains the embedded credentials can subscribe to the affected MQTT broker and read real-time telemetry from every active device across a subset of carriers connected to that broker. The issue is classified under CWE-798: Use of Hard-coded Credentials and is documented in CISA ICS Advisory ICSA-26-260-01.

Critical Impact
Attackers with the hardcoded credentials gain broad read access to live fleet data, exposing carrier operations, vehicle location, and driver activity across affected deployments.

Affected Products

Bransys ELD (all shipped units containing the embedded MQTT credentials)
Bransys MQTT broker infrastructure serving connected carriers
Downstream fleet telemetry streams for carriers connected to the affected broker

Discovery Timeline

2026-09-18 - CVE-2026-86520 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database
2026-09-25 - EPSS scoring data published for CVE-2026-86520

Technical Details for CVE-2026-86520

Vulnerability Analysis

Bransys ELD firmware embeds static MQTT client credentials that are identical across shipped devices. MQTT is a lightweight publish and subscribe protocol used by Internet of Things (IoT) fleets to stream telemetry to a central broker. Because the credentials are shared and static, any party that recovers them from a single device, from firmware, or from network traces can authenticate to the broker.

Once authenticated, an attacker can subscribe to broker topics that carry live telemetry from other carriers' devices. The disclosed data can include position, vehicle identifiers, and operational metadata used for Hours of Service compliance. The confidentiality impact is broad because a single credential set unlocks data for many tenants sharing the broker.

Root Cause

The root cause is CWE-798: Use of Hard-coded Credentials. The vendor provisioned a shared authentication secret in device firmware rather than issuing unique per-device credentials or using certificate-based mutual Transport Layer Security (mTLS). Broker authorization also fails to isolate carriers into separate topic namespaces, so a single valid client can read data belonging to unrelated tenants.

Attack Vector

Exploitation is network based and requires no user interaction or prior privileges. An attacker extracts the MQTT username and password from a purchased or salvaged ELD, from a firmware image, or from unencrypted network traffic. The attacker then connects an MQTT client such as mosquitto_sub to the vendor broker and subscribes to wildcard topics to receive live device messages. See the CISA ICS Advisory ICSA-26-260-01 and the CSAF document for advisory details.

Detection Methods for CVE-2026-86520

Indicators of Compromise

Unexpected MQTT CONNECT sessions to the Bransys broker originating from IP addresses outside the fleet's normal carrier ranges.
Long-lived subscriptions using wildcard topic filters such as # or multi-level tenant wildcards.
Repeated authentication attempts using the shared client identifier associated with production ELDs.

Detection Strategies

Inspect broker access logs for concurrent sessions using the same MQTT client identifier from geographically distant sources.
Alert on any MQTT subscribers that request topics outside of their assigned carrier or device scope.
Monitor firmware distribution channels and hardware resale markets for exposure of Bransys ELD units that could reveal embedded secrets.

Monitoring Recommendations

Enable verbose broker logging for CONNECT, SUBSCRIBE, and PUBLISH events and forward them to a centralized logging pipeline.
Baseline normal per-carrier telemetry volume and alert on sudden fan-out patterns consistent with mass subscription.
Correlate broker events with network flow data to identify subscribers not associated with known carrier infrastructure.

How to Mitigate CVE-2026-86520

Immediate Actions Required

Contact Bransys for a firmware update or credential rotation plan and apply vendor guidance from ICSA-26-260-01.
Rotate all shared MQTT credentials on the broker and invalidate previously issued static secrets.
Restrict broker network exposure to known carrier egress ranges using firewall or Virtual Private Network (VPN) controls.

Patch Information

No public vendor patch identifier is listed in the enriched data at the time of publication. Review the CISA ICS Advisory ICSA-26-260-01 and the associated CSAF document for the current remediation status and any vendor-issued firmware.

Workarounds

Migrate the broker to per-device X.509 certificate authentication with mutual TLS to eliminate shared secrets.
Enforce Access Control Lists (ACLs) on the broker so each client can only subscribe to topics belonging to its own carrier and device.
Terminate MQTT connections that use the known compromised credentials and block their reuse at the authentication layer.
Segment production broker infrastructure so a single credential compromise cannot expose multi-tenant data.

bash

# Example Mosquitto ACL restricting a device to its own topic scope
# /etc/mosquitto/acls.d/carrier-a.acl
user device-serial-0001
topic readwrite carriers/carrier-a/devices/0001/#