This vulnerability affects MAXHUB Pivot client application versions before v1.36.2. The application contains a hardcoded AES encryption key, which enables attackers to decrypt sensitive tenant email addresses and associated metadata that are otherwise encrypted. Furthermore, the vulnerability allows attackers to enroll unauthorized devices into a tenant using MQTT, potentially causing denial-of-service conditions. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker can obtain sensitive tenant email addresses and related metadata in cleartext by exploiting the hardcoded AES key. This compromises tenant confidentiality and integrity. The ability to enroll unauthorized devices via MQTT can disrupt tenant operations by causing denial-of-service conditions, impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the MAXHUB Pivot client application and monitor for unauthorized device enrollments. Avoid deploying vulnerable versions in sensitive environments if possible.