EUVD-2026-80391
GHSA-w8g5-67fq-vjx9
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for adjacent Wi-Fi reach and AC:H because the attacker must achieve control of the update-delivery/MITM path; PR:N/UI:N as no auth or interaction is needed, and malicious firmware yields full C/I/A impact.
Primary rating from Vendor (FERMAX).
CVSS VectorVendor: FERMAX
Lifecycle Timeline
6DescriptionCVE.org
The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who controls the delivery of an update to install unauthorised firmware.
AnalysisAI
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running firmware prior to 01.48.001 allows anyone who controls the delivery of an update to install unauthorized, attacker-supplied firmware on the device. The attacker must be on the adjacent network (typically the same LAN or Wi-Fi segment as the monitor) and positioned to substitute or serve the update package, such as through an on-path man-in-the-middle position or a rogue update server; no authentication or user interaction is required once that delivery-control precondition is met, and the flaw is not exploitable across the open Internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control the delivery channel of a firmware update to a FERMAX VEO or VEO-XS Wi-Fi monitor running firmware prior to 01.48.001 - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a firmware supply-chain / code-integrity flaw (CWE-347, missing signature verification) rated CVSS 4.0 7.7 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update affected VEO and VEO-XS Wi-Fi monitors to firmware 01.48.001 or later, obtained only from FERMAX's official update channel or an authorized installer workflow, and verify the running version on each unit after flashing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every FERMAX VEO and VEO-XS Wi-Fi monitor, record current firmware versions, and treat all units below 01.48.001 as exposed; where operationally possible upgrade those units to firmware 01.48.001 or later, which the vendor states is not affected, and until that upgrade is verified, move the monitors onto a dedicated VLAN or dedicated Wi-Fi SSID with no routing to guest, tenant, visitor, or general corporate networks and block their outbound update traffic to any destination other than the vendor's authoritative update endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VE
Share
External POC / Exploit Code
Leaving vuln.today