Read the docs
TI-2026-58752 Aliases CVE-2026-85628GHSA-mmjj-x36j-f536

Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability

Priority LOW 29CWE-319Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00088 0th percentileScored 2026-11-07
Fix Fixed DuoxMe (Fermax Electronica S.A.U.): 4.3.4DUOX PLUS monitor firmware (VEO Wi-Fi range) (Fermax Electronica S.A.U.): 01.50.001

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Fermax Electronica S.A.U.DuoxMebefore 4.3.44.3.4Patch availableCNA
Fermax Electronica S.A.U.DUOX PLUS monitor firmware (VEO Wi-Fi range)before 01.50.00101.50.001Patch availableCNA

Remediation

  • Fix · CNA DuoxMe (Fermax Electronica S.A.U.) Fixed in 4.3.4
  • Fix · CNA DUOX PLUS monitor firmware (VEO Wi-Fi range) (Fermax Electronica S.A.U.) Fixed in 01.50.001

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range), DuoxMe — fermax.com/security-advisories

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-59232 Improper Verification of the Firmware Signature vulnerabilityPriority LOW 35
    • TI-2026-59168 Improper Certificate Validation in the Firmware Download vulnerabilityPriority LOW 34
    • TI-2026-59150 Cleartext storage of sensitive information in Fermax Electronica S.A.U. DuoxMePriority LOW 29
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85628
  2. 2026-10-03 Alias added: GHSA-mmjj-x36j-f536

References

Advisory 1

  • TI-2026-59232 Improper Verification of the Firmware Signature vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-59168 Improper Certificate Validation in the Firmware Download vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-59150 Cleartext storage of sensitive information in Fermax Electronica S.A.U. DuoxMe CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences