Bransys, a maker of electronic logging devices for commercial truck fleets, shipped its companion app with credentials baked into the binary. A CISA advisory published September 17 describes three flaws that let anyone reaching the company’s brokers read live telemetry from every active unit.
The worst is CVE-2026-86520, an 8.7 under CVSS 4.0. Hardcoded MQTT credentials grant read access to real-time data across a subset of carriers tied to the affected broker. CVE-2026-86689 covers cleartext transmission, which CISA says lets an attacker connect and pull everything flowing through. A third bug, CVE-2026-77960, leaves hardcoded FTP credentials in place, opening a second server to unauthenticated reads.
All three trace to basic hygiene failures, CWE-798 for embedded credentials and CWE-319 for the plaintext channel. CISA lists the sector as Transportation Systems, deployed in the United States.
The exposure is narrow. No code execution, no truck control, no path to the engine. What an attacker gets is location and status data for commercial vehicles, the kind regulators treat as sensitive because it reveals routes, schedules and driver behavior.
Bransys fixed the flaws through app store releases. Android needs version 11.00.00 or newer, iOS 1.1.54. Older installs stay vulnerable until a driver updates, so fleets that manage devices centrally should push the fix rather than wait.
