Vendor
The Attendo Admin Android application version 3.0.13 and earlier contains hard-coded MQTT credentials in bundled configuration files, allowing unauthorized access to production data and potential message injection.