CVE-2026-86689: Bransys ELD Hardcoded Credentials Vulnerability

CVE-2026-86689 Overview

CVE-2026-86689 is a hardcoded credentials vulnerability affecting Bransys Electronic Logging Device (ELD) products. The device firmware ships with embedded Message Queuing Telemetry Transport (MQTT) credentials. Any actor who extracts these credentials can authenticate to the affected MQTT broker and subscribe to telemetry topics. This grants read access to real-time data for every active device across a subset of carriers connected to the broker. The issue is classified under [CWE-319: Cleartext Transmission of Sensitive Information]. CISA published the issue in ICS Advisory ICSA-26-260-01.

Critical Impact
An unauthenticated network attacker holding the shared credentials can passively harvest live fleet telemetry, including location and operational data, across multiple carriers.

Affected Products

Bransys Electronic Logging Device (ELD) firmware shipped with embedded MQTT credentials
Carriers whose fleets connect to the affected Bransys MQTT broker
Any downstream telematics workflow subscribing to the shared broker topics

Discovery Timeline

2026-09-18 - CVE-2026-86689 published to the National Vulnerability Database (NVD)
2026-09-18 - CISA publishes ICS Advisory ICSA-26-260-01
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-86689

Vulnerability Analysis

The Bransys ELD firmware embeds static MQTT broker credentials directly in the device image. MQTT is a lightweight publish-subscribe protocol widely used for telemetry in Internet of Things (IoT) and fleet telematics deployments. When every device authenticates to a broker with the same credential set, the credential effectively becomes a shared secret across the fleet. Extraction from a single device, firmware image, or intercepted session compromises the entire deployment.

Once authenticated, an attacker can subscribe to broker topics without additional authorization checks. The advisory indicates read access to real-time data for every active device across a subset of carriers connected to the affected broker. Exposed telemetry from ELDs typically includes GPS position, vehicle identifiers, hours-of-service data, and diagnostic events. This information supports large-scale tracking, competitive intelligence collection, and targeting for physical or cyber follow-on activity.

Root Cause

The root cause is the use of hardcoded credentials in the shipping firmware combined with a shared broker authorization model. There is no per-device credentialing, no topic-level access control isolating carriers, and no mechanism for credential rotation without a firmware update.

Attack Vector

The attack vector is network-based. An attacker recovers the credentials from firmware, memory, or captured traffic, then connects to the internet-reachable MQTT broker and issues subscribe operations against the telemetry topics. No user interaction is required, and no privileges on target vehicles are needed.

No verified public exploit code is available. Technical details are documented in the CISA ICS Advisory ICSA-26-260-01 and the corresponding GitHub CSAF JSON Report.

Detection Methods for CVE-2026-86689

Indicators of Compromise

Unexpected MQTT CONNECT sessions to the Bransys broker from IP addresses outside the fleet management infrastructure.
Long-lived MQTT subscriber sessions issuing wildcard SUBSCRIBE topic filters such as # or +/+/telemetry.
Duplicate client identifiers appearing simultaneously from disparate geographies, indicating credential reuse by an unauthorized party.

Detection Strategies

Instrument the MQTT broker to log CONNECT, SUBSCRIBE, and PUBLISH events with source IP, client ID, and topic filter for anomaly analysis.
Baseline expected subscriber populations and alert on new client IDs or subscribers that fetch topics belonging to carriers they do not own.
Inspect firmware images and device flash for embedded credential strings and flag any devices still using the shipped defaults.

Monitoring Recommendations

Forward broker access logs and network flow data to a centralized analytics platform for correlation with threat intelligence.
Monitor egress from broker infrastructure for connections originating from hosting providers or anonymization networks.
Track sudden increases in subscribe volume or session duration that suggest bulk telemetry harvesting.

How to Mitigate CVE-2026-86689

Immediate Actions Required

Contact Bransys for a fixed firmware release and follow the remediation steps in CISA ICS Advisory ICSA-26-260-01.
Rotate MQTT broker credentials and revoke the shared credential set embedded in vulnerable firmware.
Restrict broker network exposure with allow-listed source IP ranges for known fleet infrastructure.
Audit broker subscriber sessions for unauthorized clients and terminate any that cannot be attributed to a fleet operator.

Patch Information

No fixed version is published in the NVD entry at time of writing. Affected operators should track updates in CISA ICS Advisory ICSA-26-260-01 and coordinate with Bransys for firmware remediation and credential rotation guidance.

Workarounds

Place the MQTT broker behind a virtual private network (VPN) or mutual Transport Layer Security (mTLS) tunnel so only authenticated fleet infrastructure can reach it.
Enforce per-device X.509 client certificates at the broker to replace the shared credential model.
Apply topic-level access control lists (ACLs) so each device or carrier can only publish and subscribe to its own namespace.
Enable TLS on all MQTT connections to prevent credential capture from passive network observers.

bash

# Configuration example - Mosquitto broker ACL restricting clients to per-carrier topics
# /etc/mosquitto/acls.conf
user carrier-a-device-001
topic readwrite carriers/a/devices/001/#

user carrier-b-device-042
topic readwrite carriers/b/devices/042/#

# Deny wildcard subscriptions by default
pattern read carriers/%u/#