EUVD-2026-80386
GHSA-p3f8-3247-775c
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent MITM position (AV:A) plus the need to intercept an update event makes it AC:H; no auth required (PR:N); malicious firmware yields full C/I/A compromise.
Primary rating from Vendor (FERMAX).
CVSS VectorVendor: FERMAX
Lifecycle Timeline
4DescriptionCVE.org
The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.
AnalysisAI
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001 are not validated against a TLS certificate, so an attacker who already holds a man-in-the-middle position on the network segment carrying that traffic can deliver a spoofed update and have the device install it. The practical result is full loss of integrity, confidentiality and availability on the device, since attacker-supplied firmware runs with the monitor's privileges; the assessed severity is 7.7 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active man-in-the-middle position on the network segment carrying the device's firmware update traffic (adjacent access, AV:A) and to intercept a firmware update download by a VEO or VEO-XS Wi-Fi monitor running firmware prior to 01.48.001. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-exploitable supply-chain/update-integrity flaw, not a drive-by remote takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 01.48.001. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) and identify any running firmware prior to 01.48.001; isolate these devices on a dedicated VLAN with strict firewall rules that block inbound and outbound firmware update traffic, and disable automatic update features if configurable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VE
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today