Hardcoded AES Key Leak in MAXHUB Pivot Client

Executive Summary

This vulnerability exists in the MAXHUB Pivot client application versions prior to v1.36.2. It allows an attacker to obtain encrypted tenant email addresses and related metadata from any tenant.

Because the application contains a hardcoded AES key, the attacker can decrypt the encrypted data, gaining access to tenant email addresses and associated information in cleartext.

Additionally, an attacker may cause a denial-of-service condition by enrolling multiple unauthorized devices into a tenant via MQTT, potentially disrupting tenant operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive tenant email addresses and related metadata, which could lead to privacy breaches or targeted attacks.

Furthermore, the ability to cause a denial-of-service condition by enrolling unauthorized devices could disrupt your tenant's operations, affecting availability and service continuity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to obtain and decrypt tenant email addresses and related metadata due to a hardcoded AES key, leading to unauthorized access to sensitive personal information.

Such unauthorized access and potential exposure of personal data could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized disclosure.

Additionally, the possibility of a denial-of-service condition disrupting tenant operations may affect availability requirements under these standards.

Useful 0 Not Useful 0