The AM CLUB mobile application contains hard‑coded MQTT credentials that grant full broker access. An attacker who obtains or uses these credentials can authentically connect to the MQTT broker, read data streams, and issue control commands across different tenant boundaries. This permits the disclosure of confidential information and the manipulation of IoT devices belonging to other tenants, potentially disrupting services and violating data confidentiality, integrity, and availability.

The vulnerability affects the AM CLUB mobile application distributed by AM Automatic Machines. No specific product versions are listed in the advisory, so any released version that still contains the hard‑coded credentials is impacted.

The CVSS score of 7.8 indicates high severity. The EPSS score is unavailable, but the lack of proposed mitigate measures in the advisory suggests that exploitation could be easy once the credentials are known. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be authenticated access to the MQTT broker via the hard‑coded credentials; any user who can obtain the credentials—even an internal user—can perform the privileged actions described.