The Cybersecurity and Infrastructure Security Agency warned that three vulnerabilities in Bransys ELD could allow unauthorized access to telemetry data, broker data and firmware. The advisory, published Sept. 17, 2026, identifies Bransys ELD as an affected product in the transportation systems sector and lists deployments in the United States. CISA said successful exploitation of the vulnerabilities could expose information handled by the affected devices and connected services.
The vulnerabilities include hardcoded credentials, cleartext transmission of sensitive information and additional hardcoded credentials used for FTP access. Their CVSS ratings vary by issue and scoring version. CISA lists the first vulnerability with a CVSS version 3.1 base score of 7.5 and a CVSS version 4.0 base score of 8.7. The second has scores of 5.9 under CVSS 3.1 and 8.2 under CVSS 4.0. The third has scores of 5.3 and 6.9, respectively.
CVE-2026-86520 involves hardcoded MQTT credentials shipped with the product. CISA said the credentials grant read access to real-time data for every active device across a subset of carriers connected to the affected MQTT broker. The vulnerability is categorized under CWE-798, which covers the use of hardcoded credentials.
The advisory assigns the issue a CVSS 3.1 base score of 7.5 and a CVSS 4.0 base score of 8.7. Both scoring entries identify unauthorized network access as possible without requiring privileges or user interaction. The listed impact is focused on confidentiality, with no impact recorded for integrity or availability in the supplied scoring metrics.
CVE-2026-86689 concerns the cleartext transmission of sensitive information. CISA said the weakness could allow an attacker to connect to the broker and read all data. The vulnerability is identified under CWE-319, the category for cleartext transmission of sensitive information.
For this issue, CISA lists a CVSS 3.1 score of 5.9 and a CVSS 4.0 score of 8.2. The CVSS 3.1 entry describes network access without privileges or user interaction, while also assigning high confidentiality impact. The CVSS 4.0 entry includes a network attack path and lists confidentiality impact without an integrity or availability impact.
The third vulnerability, CVE-2026-77960, involves hardcoded FTP credentials in the affected product. CISA said an attacker could use those credentials to connect to the server and read data. The advisory categorizes the weakness under CWE-798, the same hardcoded-credentials category assigned to CVE-2026-86520.
CVE-2026-77960 carries a CVSS 3.1 base score of 5.3 and a CVSS 4.0 base score of 6.9. The scoring entries describe a network-accessible issue that does not require privileges or user interaction. Unlike the MQTT credential vulnerability, the listed confidentiality impact for this issue is low, and the scoring metrics show no impact on integrity or availability.
CISA lists the affected Bransys ELD product as known affected and identifies Android and iOS versions in the advisory. Bransys recommends that users update the system through the app store. Bransys recommends Android users run version 11.00.00 or newer and iOS users run version 1.1.54 or newer.
CISA recommends defensive measures to reduce the risk of exploitation. Those measures include minimizing network exposure for control-system devices and remote systems, placing them behind firewalls and isolating them from business networks. When remote access is required, CISA recommends more secure methods such as virtual private networks. The agency also says VPNs can have vulnerabilities and should be updated to the most current available version, while noting that VPN security depends on the connected devices.
CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation. The agency said no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of the advisory. Jaime Lightfoot was credited with reporting the vulnerabilities to CISA.