CVE-2026-77960: Use of Hard-coded Credentials in Bransys ELD

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-18
Weakness: CWE-798

Description

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Affected products

Bransys ELD: before 11.00.00; before 1.1.54 — fixed in 1.1.54, 11.00.00

How to fix

Upgrade to a fixed version: Bransys ELD 1.1.54, 11.00.00. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01

Get alerted when CVE-2026-77960 or the next vulnerability affects your stack