CVE-2026-6411

This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata from any tenant. Due to the presence of a hardcoded AES key within the application, the encrypted data can be decrypted, enabling access to tenant email addresses and associated information in cleartext. Furthermore, an attacker may be able to cause a denial-of-service condition by enrolling multiple unauthorized devices into a tenant via MQTT, potentially disrupting tenant operations.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-127-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01
https://www.maxhub.com/en/support/

Configurations

No configuration.

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad, en las versiones de la aplicación cliente MAXHUB Pivot anteriores a la v1.36.2, puede permitir a un atacante obtener direcciones de correo electrónico de inquilinos cifradas y metadatos relacionados de cualquier inquilino. Debido a la presencia de una clave AES codificada dentro de la aplicación, los datos cifrados pueden ser descifrados, lo que permite el acceso a las direcciones de correo electrónico de los inquilinos y la información asociada en texto claro. Además, un atacante podría causar una condición de denegación de servicio al registrar múltiples dispositivos no autorizados en un inquilino a través de MQTT, lo que podría interrumpir las operaciones del inquilino.

Information

Published : 2026-05-07 23:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-6411

Mitre link : CVE-2026-6411

CVE.ORG link : CVE-2026-6411

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2026-6411", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6411", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T13:05:50.323897Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "MAXHUB", "product": "MAXHUB Pivot client application", "versions": [{"status": "affected", "version": "0", "lessThan": "1.36.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.36.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T23:16:32.987", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-127-01.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.maxhub.com/en/support/", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations."}, {"lang": "es", "value": "Esta vulnerabilidad, en las versiones de la aplicaci\u00f3n cliente MAXHUB Pivot anteriores a la v1.36.2, puede permitir a un atacante obtener direcciones de correo electr\u00f3nico de inquilinos cifradas y metadatos relacionados de cualquier inquilino. Debido a la presencia de una clave AES codificada dentro de la aplicaci\u00f3n, los datos cifrados pueden ser descifrados, lo que permite el acceso a las direcciones de correo electr\u00f3nico de los inquilinos y la informaci\u00f3n asociada en texto claro. Adem\u00e1s, un atacante podr\u00eda causar una condici\u00f3n de denegaci\u00f3n de servicio al registrar m\u00faltiples dispositivos no autorizados en un inquilino a trav\u00e9s de MQTT, lo que podr\u00eda interrumpir las operaciones del inquilino."}], "lastModified": "2026-10-26T20:10:00.160", "sourceIdentifier": "ics-cert@hq.dhs.gov"}