Duoxme
Monthly
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VEO/VEO-XS Wi-Fi monitors allows an unauthenticated attacker on the adjacent Wi-Fi Direct network to intercept the home network password while onboarding is in progress. Exploitation affects deployments running DuoxMe before 4.3.4 or monitor firmware before 01.50.001, and requires the attacker to be within RF range and listening during the narrow pairing window (UI:P, AT:P), with no public exploit identified at time of analysis. The result is a bounded confidentiality compromise of the home WLAN credential rather than remote code execution or device takeover; integrity and availability of the monitor and app are not affected.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VEO/VEO-XS Wi-Fi monitors allows an unauthenticated attacker on the adjacent Wi-Fi Direct network to intercept the home network password while onboarding is in progress. Exploitation affects deployments running DuoxMe before 4.3.4 or monitor firmware before 01.50.001, and requires the attacker to be within RF range and listening during the narrow pairing window (UI:P, AT:P), with no public exploit identified at time of analysis. The result is a bounded confidentiality compromise of the home WLAN credential rather than remote code execution or device takeover; integrity and availability of the monitor and app are not affected.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.