CVE-2026-6411

{
  "id": "CVE-2026-6411",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T23:16:32.987",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad, en las versiones de la aplicación cliente MAXHUB Pivot anteriores a la v1.36.2, puede permitir a un atacante obtener direcciones de correo electrónico de inquilinos cifradas y metadatos relacionados de cualquier inquilino. Debido a la presencia de una clave AES codificada dentro de la aplicación, los datos cifrados pueden ser descifrados, lo que permite el acceso a las direcciones de correo electrónico de los inquilinos y la información asociada en texto claro. Además, un atacante podría causar una condición de denegación de servicio al registrar múltiples dispositivos no autorizados en un inquilino a través de MQTT, lo que podría interrumpir las operaciones del inquilino."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MAXHUB",
          "product": "MAXHUB Pivot client application",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.36.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "1.36.2",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T13:05:50.323897Z",
          "id": "CVE-2026-6411",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-127-01.json",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01",
      "source": "[email protected]"
    },
    {
      "url": "https://www.maxhub.com/en/support/",
      "source": "[email protected]"
    }
  ]
}