Bransys ELD

MonitorCVSS 7.5ICS-CERT ICSA-26-260-01Sep 17, 2026

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Bransys ELD contains vulnerabilities in handling telemetry data and firmware information. The application does not properly protect this data with encryption or authentication (CWE-798: Use of Hard-Coded Credentials, CWE-319: Cleartext Transmission of Sensitive Information). Successful exploitation allows unauthorized remote access to read telemetry data and firmware details without requiring authentication. The vulnerability affects Android versions prior to 11.00.00 and iOS versions prior to 1.1.54.

What this means

What could happen

An attacker with network access could read sensitive telemetry data and firmware information from the ELD system without authentication, potentially revealing operational details about vehicle location, routes, and system configuration.

Who's at risk

Fleet operators and logistics companies using Bransys ELD (Electronic Logging Device) on mobile devices. This affects fleet managers and drivers using Android or iOS devices to track vehicle telemetry and access system firmware information.

How it could be exploited

An attacker on the network sends unencrypted requests to the vulnerable ELD application to retrieve telemetry data or firmware files. The application accepts these requests without requiring authentication or encryption, allowing the attacker to read the responses directly.

Prerequisites

Network access to the ELD application port or API endpoint
Vulnerable ELD application version installed (Android before 11.00.00 or iOS before 1.1.54)

remotely exploitableno authentication requiredlow complexityaffects telemetry and firmware data exposure

Exploitability

Unlikely to be exploited — EPSS score 0.4%

Affected products (2)

2 with fix

ProductAffected VersionsFix Status

Android<11.00.00Fix available

iOS<1.1.54Fix available

Remediation & Mitigation

0/3

Do now

0/1

WORKAROUNDRestrict network access to ELD application endpoints to trusted networks only

Schedule — requires maintenance window

0/2

Patching may require device reboot — plan for process interruption

Android

HOTFIXUpdate Android ELD app to version 11.00.00 or newer via the app store

iOS

HOTFIXUpdate iOS ELD app to version 1.1.54 or newer via the app store

CVEs (3)

CVE-2026-77960 CVE-2026-86520 CVE-2026-86689

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/16f19dd5-5ab0-4eff-80a7-b9ffc63dded8

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.