CVE-2026-11535: An unauthorized access vulnerability exists in the PcSuite APP

Synopsis

An unauthorized access vulnerability exists in the vivo PcSuite application, affecting versions below 6.2.5. The flaw is reachable from an adjacent network (such as a local LAN or shared Wi-Fi segment) and requires no authentication, allowing an attacker in range to gain unauthorized access to the victim's device. Successful exploitation gives the attacker read and write access to sensitive data on both the local device and connected systems, and can disrupt downstream services. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attack requires adjacent-network access, such as a shared LAN, Wi-Fi segment, or VPN, meaning the attacker must be co-located on the same network segment as the target.

• AuthenticationNot required

  No credentials or prior account access are needed; the attacker can reach the vulnerable service without authenticating.

• Victim interactionNot required

  The exploit does not require the victim to take any action such as clicking a link or opening a file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Attacker reads sensitive data stored on the victim's device, including files, contacts, and application data.
• Attacker writes or modifies data on the victim's device, enabling tampering with stored content or application state.
• Attacker gains read and write access to systems connected through the PcSuite integration, extending the breach beyond the immediate device.
• Downstream services dependent on the compromised connected systems can be disrupted, causing availability impact across the broader environment.