Sensitive Data Transmission Flaw in DuoxMe Application and VEO Wi-Fi Monitors by Fermax
CVE-2026-85628

7HIGH

Key Information:

Vendor

Fermax Electronica S.a.u.

Status
Duoxme
Duox Plus Monitor Firmware (veo Wi-fi Range)
Vendor
CVE Published:
16 September 2026

What is CVE-2026-85628?

The DuoxMe application and VEO Wi-Fi monitors have a significant vulnerability that allows for unencrypted transmission of home Wi-Fi credentials during the pairing process. This flaw affects versions of the application prior to 4.3.4 and the monitor firmware below 01.50.001. Attackers on the same Wi-Fi Direct network could intercept sensitive information, potentially gaining unauthorized access to the user's network, thus posing serious security risks.

Affected Version(s)

DUOX PLUS monitor firmware (VEO Wi-Fi range) VEO-WIFI 0 < 01.50.001

DuoxMe Android 0 < 4.3.4

References

https://fermax.com/security-advisories
vendor-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro J. Núñez-Cacho Fuentes (Tunelko)
INCIBE-CERT
.