Attendo Admin EUVD-2026-115368

Exploitation requires the attacker to obtain and decompile the Attendo/Petpooja Payroll Admin Android APK (version 3.0.13 or earlier, publicly available on Google Play) and parse its bundled Flutter configuration assets - specifically files such as production.json and device-command configuration - to recover the embedded production MQTT broker credentials. The production MQTT broker must then be reachable from the attacker's network over TCP 1883 and must still accept those credentials. Limiting factors: exploitation depends entirely on the broker remaining network-accessible and the hard-coded credentials remaining valid and unrotated; it is constrained to the specific affected app versions, and no authentication to the application itself is needed. No special in-app configuration or user interaction is required, but the offline decompilation step is a precondition before any network access.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:L) scores 8.8 and signals remote, low-complexity, unauthenticated exposure of high-value confidential data with limited integrity impact - a plausibly real priority for any organization running this product. However, the signals are mixed on breadth of exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week', not 'act_now' or 'emergency'. The only exploit signal is a single public write-up (Medium) referenced as a PoC - it is not verified as working exploit code. A notable nuance the CVSS vector obscures: the AV:N/PR:N rating reflects that the exploitable asset is a network-reachable MQTT broker and the credentials ship inside a publicly downloadable APK, but the attack also involves an offline step (decompiling the app and parsing bundled Flutter assets) before any network action. This is a credential-exposure flaw (CWE-798), so realistic risk hinges on whether the production broker on TCP 1883 remains reachable and whether the hard-coded credentials are still valid - if the vendor rotates them or firewalls the broker, the network impact collapses. Net: a credible, well-documented information-disclosure issue for affected deployments, but the absence of KEV/EPSS and the niche product footprint point to targeted rather than mass risk.

An attacker downloads the publicly available Attendo/Petpooja Payroll Admin APK from Google Play, decompiles it, and extracts hard-coded MQTT broker credentials from bundled Flutter configuration assets such as production.json. Because the broker is reachable over the network with low complexity and no authentication to the app required, the attacker connects to it on TCP 1883, subscribes to attendance topics to harvest employee PII and Base64 photographs, and can publish crafted messages to inject data. A public PoC reference (a Medium write-up) documents this chain, though it is not verified as working exploit code.