CVE-2026-77960 identifies a CWE-798 vulnerability in Bransys ELD where hardcoded MQTT credentials are embedded in the product. These credentials permit unauthorized read access to real-time data across all active devices connected to the affected MQTT broker for a subset of carriers. The vulnerability affects versions prior to 11.00.00 and 1.1.54. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is available to confirm remediation status.

An attacker with knowledge of the hardcoded MQTT credentials can gain read access to real-time data from all active devices connected to the affected MQTT broker for certain carriers. This exposure is limited to confidentiality impact only, with no integrity or availability impact reported. The vulnerability does not require privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the MQTT broker and monitoring for unauthorized access attempts. Replace or disable hardcoded credentials if possible through configuration changes or updates.