CVE-2026-6411
Hardcoded AES Key Leak in MAXHUB Pivot Client
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| maxhub | pivot | to 1.36.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the MAXHUB Pivot client application versions prior to v1.36.2. It allows an attacker to obtain encrypted tenant email addresses and related metadata from any tenant.
Because the application contains a hardcoded AES key, the attacker can decrypt the encrypted data, gaining access to tenant email addresses and associated information in cleartext.
Additionally, an attacker may cause a denial-of-service condition by enrolling multiple unauthorized devices into a tenant via MQTT, potentially disrupting tenant operations.
How can this vulnerability impact me? :
This vulnerability can impact you by exposing sensitive tenant email addresses and related metadata, which could lead to privacy breaches or targeted attacks.
Furthermore, the ability to cause a denial-of-service condition by enrolling unauthorized devices could disrupt your tenant's operations, affecting availability and service continuity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to obtain and decrypt tenant email addresses and related metadata due to a hardcoded AES key, leading to unauthorized access to sensitive personal information.
Such unauthorized access and potential exposure of personal data could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized disclosure.
Additionally, the possibility of a denial-of-service condition disrupting tenant operations may affect availability requirements under these standards.