{"id":"CVE-2026-6411","aliases":["EUVD-2026-28471","GHSA-m8jc-jjj9-hgc8"],"status":"published","title":"MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm","description":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00159,"percentile":0.05052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327"],"published":"2026-05-07T22:25:54Z","modified":"2026-10-26T20:10:00Z","products":[{"vendor":"maxhub","product":"maxhub pivot client application"}],"references":[{"url":"https://www.maxhub.com/en/support/"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-127-01.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6411"},{"url":"https://www.maxhub.com/en/support"},{"url":"https://github.com/advisories/GHSA-m8jc-jjj9-hgc8"}],"sources":{"cve":[{"id":"CVE-2026-6411","title":"MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm","description":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations.","status":"published","published":"2026-05-07T22:25:54.959Z","modified":"2026-05-08T13:06:12.227Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-28471","description":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations.","status":"published","published":"2026-05-07T22:25:54Z","modified":"2026-05-08T13:06:12Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:14.505765Z"}],"ghsa":[{"id":"GHSA-m8jc-jjj9-hgc8","title":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow...","description":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations.","status":"published","published":"2026-05-08T00:31:35Z","modified":"2026-05-08T00:31:42Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:07:57.010667Z"}],"nvd":[{"id":"CVE-2026-6411","description":"This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations.","status":"published","published":"2026-05-07T23:16:32.987Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:12:17.842772Z"}]}}