« Volver al listado

CVE-2026-85628

Estado: AplazadaAlta (7)—

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:P indica interacción de usuario (emparejamiento); AV:A con AT:P (Wi-Fi Direct) requiere estar en red adyacente. Intercepta credenciales sin cifrar en el proceso de emparejamiento.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementMulti-factor AuthenticationApplication Developer GuidanceActive Directory ConfigurationUser TrainingPrivileged Account Management

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Duoxme — Duoxme ApplicationAIVEO — VEO Wifi MonitorAIVEO — VEO XS Wifi MonitorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-85628",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85628",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-16T18:08:28.842464Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "539080bd-5750-4cce-b30b-eed9a4ef6dcc",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "539080bd-5750-4cce-b30b-eed9a4ef6dcc",
      "affectedData": [
        {
          "vendor": "Fermax Electronica S.A.U.",
          "product": "DuoxMe",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.4",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Android",
            "iOS"
          ],
          "packageName": "com.fermax.blue.app",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Fermax Electronica S.A.U.",
          "product": "DUOX PLUS monitor firmware (VEO Wi-Fi range)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "01.50.001",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "VEO-WIFI",
            "VEO-XS-WIFI",
            "VEO-XS-WIFI-DDA",
            "VEO-XL-WIFI",
            "VEO-XL-WIFI-DDA"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-16T10:16:53.670",
  "references": [
    {
      "url": "https://fermax.com/security-advisories",
      "source": "539080bd-5750-4cce-b30b-eed9a4ef6dcc"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "539080bd-5750-4cce-b30b-eed9a4ef6dcc",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password."
    }
  ],
  "lastModified": "2026-09-18T19:44:10.957",
  "sourceIdentifier": "539080bd-5750-4cce-b30b-eed9a4ef6dcc"
}