CVE-2026-86689: Cleartext Transmission of Sensitive Information in Bransys ELD

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-18
Weakness: CWE-319

Description

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Affected products

Bransys ELD: before 11.00.00; before 1.1.54 — fixed in 1.1.54, 11.00.00

How to fix

Upgrade to a fixed version: Bransys ELD 1.1.54, 11.00.00. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01

Get alerted when CVE-2026-86689 or the next vulnerability affects your stack