Advisories › Bransys › ICSA-26-260-01
Bransys ELD: 3 CVEs, High 7.5
Summary
CISA reports 3 vulnerabilities in Bransys Android, iOS. Weakness types: Use of Hard-coded Credentials, Cleartext Transmission of Sensitive Information. Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
What to do: Prioritize: Bransys recommends that users update their system through the app store. Android users should be on version 11.00.00 or newer. iOS users should be on version 1.1.54 or newer.
At a glance
- Vendor
- Bransys
- Products
- Android, iOS
- CVEs
- CVE-2026-86520, CVE-2026-86689, CVE-2026-77960
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems
- Deployed
- United States
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-86520 | Use of Hard-coded Credentials | 7.5 | – | No | The affected product is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker. |
| CVE-2026-86689 | Cleartext Transmission of Sensitive Information | 5.9 | – | No | The affected product is susceptible to cleartext transmission of sensitive information, which could allow an attacker to connect to the broker and read all data. |
| CVE-2026-77960 | Use of Hard-coded Credentials | 5.3 | – | No | The affected product ships with hardcoded FTP credentials which could allow an attacker to connect to the server and read data. |
Affected products (2)
- Bransys Android: <11.00.00
- Bransys iOS: <1.1.54
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Bransys recommends that users update their system through the app store. Android users should be on version 11.00.00 or newer. iOS users should be on version 1.1.54 or newer.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.