Man-in-the-Middle Vulnerability in VEO and VEO-XS Wi-Fi Monitors by Fermax
CVE-2026-86474

7.7HIGH

Key Information:

Vendor

Fermax Electronica S.a.u.

Status
Duox Plus Monitor Firmware (veo Wi-fi Range)
Vendor
CVE Published:
16 September 2026

What is CVE-2026-86474?

A vulnerability exists in VEO and VEO-XS Wi-Fi monitors due to insufficient validation of TLS certificates while downloading firmware updates. This flaw allows attackers to intercept communication and execute man-in-the-middle attacks, potentially compromising the integrity and security of the firmware updates. Users are advised to update their devices to version 01.48.001 or later to mitigate this risk.

Affected Version(s)

DUOX PLUS monitor firmware (VEO Wi-Fi range) VEO-WIFI 0 < 01.48.001

References

https://fermax.com/security-advisories
vendor-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro J. Núñez-Cacho Fuentes (Tunelko)
INCIBE-CERT
.