{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aattendoadminandroid/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:attendo:admin:*:*:*:*:*:android:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-119736"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Attendo Admin Android application (\u003c= 3.0.13)"],"_cs_severities":["high"],"_cs_tags":["mobile-security","android","vulnerability","mqtt","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["Attendo"],"content_html":"\u003cp\u003eThe Attendo (formerly Petpooja Payroll) Admin Android application, versions 3.0.13 and earlier, contains hard-coded credentials for a production MQTT broker. These credentials are embedded within Flutter configuration assets, specifically in files such as production.json and device-command configuration files. Unauthorized parties can extract these credentials by decompiling the APK file.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to authenticate to the production MQTT broker over TCP 1883. Access enables the retrieval of sensitive data from messaging topics, including employee attendance records, personal identifiers, Base64-encoded photographs, and device telemetry. Furthermore, attackers can publish messages to these topics, facilitating unauthorized message injection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all mobile devices within the corporate environment running the Attendo Admin application.\u003c/li\u003e\n\u003cli\u003eUpgrade the Attendo Admin Android application to a version released after 3.0.13 once a patch is provided by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement network-level monitoring or restrictions on outbound connections to the MQTT broker (TCP 1883) from non-authorized devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T19:48:28Z","date_published":"2026-11-02T19:48:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-attendo-android-credentials/","summary":"The Attendo Admin Android application version 3.0.13 and earlier contains hard-coded MQTT credentials in bundled configuration files, allowing unauthorized access to production data and potential message injection.","title":"Attendo Admin Android Application: Hard-coded MQTT Broker Credentials (CVE-2026-119736)","url":"https://feed.craftedsignal.io/briefs/2026-11-attendo-android-credentials/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:attendo:admin:*:*:*:*:*:android:*:*","version":"https://jsonfeed.org/version/1.1"}