Duox Plus Monitor Firmware Veo Wi Fi Range
Monthly
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running firmware prior to 01.48.001 allows anyone who controls the delivery of an update to install unauthorized, attacker-supplied firmware on the device. The attacker must be on the adjacent network (typically the same LAN or Wi-Fi segment as the monitor) and positioned to substitute or serve the update package, such as through an on-path man-in-the-middle position or a rogue update server; no authentication or user interaction is required once that delivery-control precondition is met, and the flaw is not exploitable across the open Internet. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); devices already updated to 01.48.001 or later are not affected.
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001 are not validated against a TLS certificate, so an attacker who already holds a man-in-the-middle position on the network segment carrying that traffic can deliver a spoofed update and have the device install it. The practical result is full loss of integrity, confidentiality and availability on the device, since attacker-supplied firmware runs with the monitor's privileges; the assessed severity is 7.7 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), and exploitation is conditional: the attacker must be network-adjacent, must catch or induce a firmware update event, and cannot succeed against monitors already updated to 01.48.001 or later. This is a supply-chain/update-integrity weakness rather than a drive-by remote takeover, and no device credentials are required (PR:N).
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VEO/VEO-XS Wi-Fi monitors allows an unauthenticated attacker on the adjacent Wi-Fi Direct network to intercept the home network password while onboarding is in progress. Exploitation affects deployments running DuoxMe before 4.3.4 or monitor firmware before 01.50.001, and requires the attacker to be within RF range and listening during the narrow pairing window (UI:P, AT:P), with no public exploit identified at time of analysis. The result is a bounded confidentiality compromise of the home WLAN credential rather than remote code execution or device takeover; integrity and availability of the monitor and app are not affected.
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running firmware prior to 01.48.001 allows anyone who controls the delivery of an update to install unauthorized, attacker-supplied firmware on the device. The attacker must be on the adjacent network (typically the same LAN or Wi-Fi segment as the monitor) and positioned to substitute or serve the update package, such as through an on-path man-in-the-middle position or a rogue update server; no authentication or user interaction is required once that delivery-control precondition is met, and the flaw is not exploitable across the open Internet. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); devices already updated to 01.48.001 or later are not affected.
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001 are not validated against a TLS certificate, so an attacker who already holds a man-in-the-middle position on the network segment carrying that traffic can deliver a spoofed update and have the device install it. The practical result is full loss of integrity, confidentiality and availability on the device, since attacker-supplied firmware runs with the monitor's privileges; the assessed severity is 7.7 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), and exploitation is conditional: the attacker must be network-adjacent, must catch or induce a firmware update event, and cannot succeed against monitors already updated to 01.48.001 or later. This is a supply-chain/update-integrity weakness rather than a drive-by remote takeover, and no device credentials are required (PR:N).
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VEO/VEO-XS Wi-Fi monitors allows an unauthenticated attacker on the adjacent Wi-Fi Direct network to intercept the home network password while onboarding is in progress. Exploitation affects deployments running DuoxMe before 4.3.4 or monitor firmware before 01.50.001, and requires the attacker to be within RF range and listening during the narrow pairing window (UI:P, AT:P), with no public exploit identified at time of analysis. The result is a bounded confidentiality compromise of the home WLAN credential rather than remote code execution or device takeover; integrity and availability of the monitor and app are not affected.