MAXS Main CVE-2026-107044

The required target is ProjectMAXS MAXS Main v0.5.19 (versionCode 19), a modular Android automation app whose command/transport mechanism is protected by insecure permissions (CWE-732); an attacker must be able to reach that insufficiently restricted interface to issue or alter MAXS commands. The CVSS vector states no authentication, privileges, or user interaction are needed, which limits defensive barriers; however, the exact trigger surface is not described in the available sources - insecure-permission flaws on Android are usually exploited by a malicious co-installed application or local actor via an exported component rather than over an open network, so the practical limiting factor is likely local presence on the device despite the AV:N label. Impact is confined to integrity of the app's automation/command mechanism (C:N, A:N); confidentiality and availability are not affected.

Signals are mixed and point to a low real-world priority despite the 7.5 'High' base score. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, unauthenticated, integrity-only flaw, and SSVC rates it Automatable:yes with partial technical impact, which together would normally argue for attention. However, EPSS is only 0.17% (6th percentile), the vulnerability is NOT on CISA KEV (no confirmed active exploitation), and the affected product - ProjectMAXS MAXS Main, a niche F-Droid Android remote-control app - has a very small deployment footprint, so Automatable:yes does not translate into broad opportunistic risk. There is also a notable conflict between the vector and the mechanism: the defect is CWE-732 (incorrect/insecure permissions) in an Android application, which typically means a co-installed malicious app or local actor abusing an exported/over-permissive component rather than a truly remote network attack; AV:N as assigned by MITRE should be verified against the actual transport, because insecure-permission Android flaws are usually local (AV:L). The vuln.today 'this_week' label and SSVC poc status justify tracking and patching, but the combination of low EPSS, no KEV, integrity-only impact (C:N/A:N), and tiny install base makes this a lower urgency than the raw score suggests.

A malicious or unauthorized party interacts with MAXS Main's insufficiently protected command/transport interface and issues or tampers with MAXS commands that the app should have restricted, manipulating its automation mechanism without legitimate authorization. A proof-of-concept is referenced in a public F-Droid Android advisory, though it is not verified as working exploit code. Because CVSS rates attack complexity low with no privileges or user interaction required, triggering the manipulation is straightforward once the exposed interface is reachable.