EUVD-2026-83133
GHSA-v8qq-7pf7-5xq9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Hardcoded credentials are trivially recoverable so AC:L not AC:H; network-reachable broker with no auth (PR:N/UI:N); read-only telemetry exposure means C:H, I:N, A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.
AnalysisAI
Bransys ELD ships with hardcoded MQTT credentials that grant read access to real-time telemetry for active devices across a subset of carriers whose hardware was provisioned against the affected MQTT broker. An unauthenticated remote attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) who can reach that broker and recover the embedded credentials from firmware or client software can subscribe and read live operational data; impact is confidentiality-only (C:H/I:N/A:N) and is scoped to devices on that specific broker, not all Bransys customers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Bransys ELD deployment uses the affected MQTT broker to which the hardcoded credentials grant access, and that the attacker can reach that broker over the network and recover the shipped credentials (from firmware or client software). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine confidentiality exposure but a moderate-priority one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the authoritative source is the CISA ICS advisory ICSA-26-260-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01, and remediation should begin with direct engagement with Bransys to obtain corrected firmware that removes the hardcoded credentials and replaces them with per-device, rotatable secrets, plus confirmation of whether the affected broker is being decommissioned. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Bransys ELD devices and the associated MQTT broker, then restrict network access to that broker using firewall rules or VLAN segmentation to only trusted IPs; enable logging and monitor for unauthorized subscription attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every
Bransys ELD ships with hardcoded MQTT credentials that allow unauthenticated remote attackers to subscribe to the real-t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today