CVE-2026-6411
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-327
Uso de algoritmo criptográfico vulnerable o inseguro
Fecha de publicación:
07/05/2026
Última modificación:
08/05/2026
Descripción
*** Pendiente de traducción *** This vulnerability, in the MAXHUB Pivot client application versions <br />
prior to v1.36.2, may allow an attacker to obtain encrypted tenant email<br />
addresses and related metadata from any tenant. Due to the presence of a<br />
hardcoded AES key within the application, the encrypted data can be <br />
decrypted, enabling access to tenant email addresses and associated <br />
information in cleartext. Furthermore, an attacker may be able to cause a<br />
denial-of-service condition by enrolling multiple unauthorized devices <br />
into a tenant via MQTT, potentially disrupting tenant operations.
Impacto
Puntuación base 3.x
7.30
Gravedad 3.x
ALTA