Bransys ELD App Shipped With Hardcoded Login Credentials

The Cybersecurity and Infrastructure Security Agency disclosed three vulnerabilities on Thursday in Bransys ELD, an electronic logging device app that commercial truckers use to satisfy a federal hours-of-service mandate, the worst of which shipped with a password baked directly into the software. Independent researcher Jaime Lightfoot, who runs Lightfoot Labs and specializes in embedded systems used in trucking, reported all three flaws to CISA.

CISA's advisory says the app, published by Bransys under the name EzToTrack and registered with the Federal Motor Carrier Safety Administration under ELD identifier GDGGPS, carries "no known public exploitation" as of Thursday. The three flaws are tracked as CVE-2026-86520, CVE-2026-86689 and CVE-2026-77960, and CISA rated all three against both the older CVSS 3.1 and newer CVSS 4.0 scales, which put two of the three more than 2 points apart.

What the hardcoded credentials expose

CVE-2026-86520 is a hardcoded MQTT credential, MQTT being the lightweight messaging protocol many connected devices use to publish live sensor data to a central broker. "The affected product is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker," the advisory says. CISA scores it 7.5 under CVSS 3.1 and 8.7 under CVSS 4.0, both High, and the attack needs no authentication of its own since the credential ships built into every copy of the app.

Two more flaws, smaller blast radius

CVE-2026-86689 covers cleartext transmission of sensitive data, which CISA says "could allow an attacker to connect to the broker," and CVE-2026-77960 is a second hardcoded credential, this time for FTP, letting an attacker "connect to the server and read data." Both carry lower CVSS 3.1 scores, 5.9 and 5.3, but CVSS 4.0 rates them 8.2 and 6.9, a gap that reflects the newer scale's heavier weighting of network-reachable flaws that need no privileges at all.

CVE	CVSS 3.1	CVSS 4.0	What it exposes
CVE-2026-86520	7.5 High	8.7 High	Real-time device data via hardcoded MQTT login
CVE-2026-86689	5.9 Medium	8.2 High	Cleartext data readable in transit
CVE-2026-77960	5.3 Medium	6.9 Medium	Server data via hardcoded FTP login

Fixed before the advisory shipped

Bransys's fix landed weeks before CISA's public notice. The iOS App Store listing for EzToTrack shows its current build, version 1.1.54, the exact version CISA lists as patched, released Aug. 27, and CISA lists Android 11.00.00 as the fixed build on that platform. Anyone whose phone auto-updates has likely been running patched software since late August; what CISA's advisory does not say is how many of the app's self-described "thousands of commercial drivers across North America", Bransys's own marketing claim, were still on an older build when the credentials were live, or how long the hardcoded values had shipped before Lightfoot found them.

CISA's standard mitigation advice for the flaws, isolating the device behind a firewall, keeping it off the internet, using a VPN for remote access, is boilerplate lifted from advisories written for fixed industrial control equipment, the same template CISA applied a day earlier to a 9.8-rated authentication bypass in a Siemens Reyrolle protection relay. None of it maps cleanly onto a phone app that talks to a cloud MQTT broker by design, which is the gap the advisory leaves for a driver or fleet manager to close on their own: update the app, since there is no firewall to put around a smartphone.

The stakes of a hackable ELD are not hypothetical. A 2024 demonstration by Colorado State University researchers, reported by The Register, used default Wi-Fi credentials on a different ELD brand to build a truck-to-truck worm that re-flashed a device's firmware and sent commands that slowed a moving truck in 14 seconds, a reminder that the category of device, not just this one vendor, sits on the same kind of hardcoded and default-credential weakness the MikroTik RouterOS botnet campaign exploited in August. The FMCSA's mandate keeps some version of an ELD running in most of the estimated 14 million medium- and heavy-duty trucks on US roads.