Sensitive Information Storage Vulnerability in DuoxMe Android App by Fermax
CVE-2026-86443

6.9MEDIUM

Key Information:

Vendor

Fermax Electronica S.a.u.

Status
Duoxme
Vendor
CVE Published:
16 September 2026

What is CVE-2026-86443?

The DuoxMe application for Android, prior to version 4.3.4, exhibits a security flaw involving the cleartext storage of sensitive information. This vulnerability allows an attacker who gains local access to the device to retrieve stored credentials, potentially leading to impersonation of user accounts. Users of the DuoxMe app should promptly update to the latest version to mitigate any associated risks.

Affected Version(s)

DuoxMe Android 0 < 4.3.4

References

https://fermax.com/security-advisories
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-2909
related

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro J. Núñez-Cacho Fuentes (Tunelko)
INCIBE-CERT
.