CVE-2026-6411
Severity CVSS v4.0:
Pending analysis
Type:
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
Publication date:
07/05/2026
Last modified:
08/05/2026
Description
This vulnerability, in the MAXHUB Pivot client application versions <br />
prior to v1.36.2, may allow an attacker to obtain encrypted tenant email<br />
addresses and related metadata from any tenant. Due to the presence of a<br />
hardcoded AES key within the application, the encrypted data can be <br />
decrypted, enabling access to tenant email addresses and associated <br />
information in cleartext. Furthermore, an attacker may be able to cause a<br />
denial-of-service condition by enrolling multiple unauthorized devices <br />
into a tenant via MQTT, potentially disrupting tenant operations.
Impact
Base Score 3.x
7.30
Severity 3.x
HIGH