This vulnerability affects MAXHUB Pivot client application versions before v1.36.2. The application uses a hardcoded AES key to encrypt tenant email addresses and metadata, which attackers can extract and decrypt, compromising tenant information confidentiality. Furthermore, the vulnerability allows attackers to enroll unauthorized devices through MQTT, potentially causing denial-of-service conditions by disrupting tenant operations. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

An attacker can obtain sensitive tenant email addresses and associated metadata in cleartext by exploiting the hardcoded AES key, leading to confidentiality breaches. The ability to enroll unauthorized devices via MQTT can disrupt tenant operations, causing denial-of-service conditions and impacting availability and integrity of the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure of the vulnerable MAXHUB Pivot client application and monitor for unauthorized device enrollments. Avoid deploying affected versions in sensitive environments where tenant data confidentiality and service availability are critical.