EUVD-2026-83127
GHSA-g6x8-qp3x-c79j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable broker with embedded static credentials needs no auth or user interaction (PR:N/UI:N); impact is broad real-time data read only, so C:H with I:N/A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.
AnalysisAI
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every active device belonging to a subset of carriers connected to the affected MQTT broker. Because the static credential is embedded in the product, remote attackers who recover it - for example by reverse-engineering the shipped binary or firmware - can subscribe to the broker with any standard MQTT client, and no user interaction or per-victim authentication is required (PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the affected Bransys ELD software/firmware that ships with the hardcoded MQTT credentials, and network reachability to the specific MQTT broker those credentials authenticate to. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority exposure rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the available intelligence, so the authoritative fix guidance should be taken from CISA ICS advisory ICSA-26-260-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01) and from Bransys directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Bransys ELD devices and the MQTT brokers they use, isolate or restrict broker access to trusted networks and IP ranges, enable MQTT logging and alerting for unauthorized subscriptions, and rotate or disable the embedded MQTT credentials where operationally supported. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 throu
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messa
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PU
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today