MAXHUB Pivot
Plan Patch7.5ICS-CERT ICSA-25-338-02Dec 4, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
The Pivot client application contains a vulnerability that allows an attacker to request a password reset without proper authorization, potentially gaining unauthorized access to user accounts. The vulnerability affects versions prior to v1.36.2.
What this means
What could happen
An attacker could reset your account password and gain unauthorized access to your Pivot client, potentially allowing them to access sensitive collaborative workspace data or impersonate your organization's users.
Who's at risk
Organizations using MAXHUB Pivot client for collaborative workspace management, particularly those with remote or hybrid work environments where staff rely on Pivot for scheduling and coordination. Anyone managing shared resources or digital displays through Pivot should prioritize this update.
How it could be exploited
An attacker would request a password reset for a targeted Pivot account. If the reset mechanism lacks proper authorization checks, the attacker could intercept or complete the reset and take over the account without the legitimate user's knowledge.
Prerequisites
- Network access to the Pivot client application or its backend authentication service
- Ability to interact with the password reset mechanism
- Knowledge of a valid target account identifier (username or email)
remotely exploitableno authentication required for password resetlow complexity attackaccount takeover risk
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (1)
ProductAffected VersionsFix Status
Pivot client application: <v1.36.2<v1.36.2v1.36.2 or later
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict network access to Pivot client and authentication services to authorized users only via firewall rules
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpgrade Pivot client application to v1.36.2 or newer
HARDENINGImplement VPN requirements for remote access to Pivot services
Long-term hardening
0/1HARDENINGImplement additional account security measures such as multi-factor authentication (MFA) on Pivot accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/c1e63e0a-8b75-46ad-8ed0-6f20f2462ac5