The vulnerability exists in the MAXHUB Pivot client application before version 1.36.2. A hardcoded AES key allows an attacker to decrypt data that is otherwise encrypted, exposing tenant email addresses and related metadata. In addition, an attacker may enroll multiple unauthorized devices into a tenant via MQTT, which can degrade or halt tenant operations. The weakness is formally classified as CWE‑327, a broken or risky cryptographic algorithm.

All installations of the MAXHUB Pivot client application older than v1.36.2 are affected. Users of v1.36.2 or newer are not susceptible. The flaw impacts any tenant that utilizes the client application for managing its environment.

The CVSS score of 7.3 reflects a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The exploit is facilitated by the presence of a static cryptographic key and an MQTT interface that can accept unauthorized device enrollments, implying that an attacker with network or local access could read sensitive information and potentially disrupt services. The lack of a listed KEV suggests no current exploitation reports, but the high CVSS indicates substantial potential impact if the vulnerability is abused.