MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm

published 2026-05-07 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-28471

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata from any tenant. Due to the presence of a hardcoded AES key within the application, the encrypted data can be decrypted, enabling access to tenant email addresses and associated information in cleartext. Furthermore, an attacker may be able to cause a denial-of-service condition by enrolling multiple unauthorized devices into a tenant via MQTT, potentially disrupting tenant operations.

Patch / fix

fixed in 1

MAXHUB MAXHUB Pivot client application 1.36.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-127-01 updated 2026-05-07 cvss 7.3

MAXHUB Pivot client application

MAXHUB Pivot client application <v1.36.2
affected: mitigation maxhub.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-05-08)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

MAXHUB MAXHUB Pivot client application

Classification

Weakness

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

CVE List CVE-2026-6411
NVD CVE-2026-6411

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary