CVE-2026-85628: VEO Wi-Fi Monitor Credential Disclosure Flaw

CVE-2026-85628 Overview

CVE-2026-85628 is a cleartext transmission vulnerability [CWE-319] affecting the pairing process between the Fermax DuoxMe mobile application and Fermax VEO and VEO-XS Wi-Fi monitors. During pairing, the home Wi-Fi credentials are sent without encryption over a Wi-Fi Direct connection. An attacker within radio range of the Wi-Fi Direct network can intercept the network password. The issue affects DuoxMe application versions prior to 4.3.4 and monitor firmware prior to 01.50.001.

Critical Impact
An adjacent-network attacker can capture the home Wi-Fi password in cleartext during device pairing, gaining persistent access to the victim's home network.

Affected Products

Fermax DuoxMe application versions prior to 4.3.4
Fermax VEO Wi-Fi monitor firmware prior to 01.50.001
Fermax VEO-XS Wi-Fi monitor firmware prior to 01.50.001

Discovery Timeline

2026-09-16 - CVE-2026-85628 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85628

Vulnerability Analysis

The DuoxMe application provisions a VEO or VEO-XS monitor onto the user's home wireless network through a temporary Wi-Fi Direct link. During this exchange, the application sends the home Service Set Identifier (SSID) and Wi-Fi Protected Access (WPA) passphrase to the monitor without applying transport encryption. Any device that can associate with, or passively observe, the Wi-Fi Direct channel during pairing can recover the credentials.

Credential exposure grants an attacker durable access to the victim's home network, bypassing perimeter controls and enabling reconnaissance of internal devices, lateral movement, and interception of internal traffic. The attack requires physical proximity and coincidental timing with a pairing event, which raises the practical bar but does not eliminate the risk in dense residential or shared-building environments.

Root Cause

The root cause is missing encryption of sensitive data in transit [CWE-319]. The pairing protocol between DuoxMe and the VEO or VEO-XS monitor does not wrap Wi-Fi credentials in a Transport Layer Security (TLS) channel or an equivalent authenticated key-exchange, so the passphrase is exposed as cleartext on the Wi-Fi Direct segment.

Attack Vector

Exploitation requires adjacency to the Wi-Fi Direct network established during pairing and coincides with user interaction (the pairing action itself). An attacker positions a wireless capture device within range of the target dwelling, waits for a pairing session, and intercepts the credential exchange. No authentication to the target home network is required prior to the attack.

No public proof-of-concept, exploit code, or exploitation-in-the-wild reporting is available at the time of publication. See the Fermax Security Advisories for vendor technical details.

Detection Methods for CVE-2026-85628

Indicators of Compromise

Unexpected Wi-Fi Direct sessions originating near a VEO or VEO-XS monitor outside of a planned pairing window.
New or unknown wireless clients associating with the home Service Set Identifier shortly after a DuoxMe pairing event.
Presence of monitor mode or packet-capture-capable wireless hardware in the vicinity during device onboarding.

Detection Strategies

Review the home router's associated-clients list after each DuoxMe pairing session and correlate any new MAC address against known devices.
Enable and inspect wireless intrusion detection logs on managed access points for anomalous probe or association activity during pairing windows.
Track firmware and application versions across deployed VEO and VEO-XS monitors to identify units still on vulnerable builds.

Monitoring Recommendations

Alert on connections from previously unseen MAC addresses on the primary home or tenant Wi-Fi network.
Monitor DHCP lease assignments for new clients following a documented pairing operation.
Log and review router administrative events, including WPA passphrase changes and guest-network activity.

How to Mitigate CVE-2026-85628

Immediate Actions Required

Upgrade the DuoxMe application to version 4.3.4 or later on all mobile devices used for provisioning.
Update Fermax VEO and VEO-XS monitor firmware to version 01.50.001 or later before initiating any new pairing.
Rotate the home Wi-Fi passphrase on any network where pairing was performed with vulnerable versions.

Patch Information

Fermax has released fixed versions that address the cleartext transmission of Wi-Fi credentials. Apply DuoxMe application 4.3.4 or later and monitor firmware 01.50.001 or later. Refer to the Fermax Security Advisories for release notes and download instructions.

Workarounds

Perform pairing only in low-density radio environments where adjacent adversaries are unlikely to be within range.
Provision the monitor on a temporary isolated Service Set Identifier, then move it and rotate the primary passphrase after pairing completes.
Segment IoT devices onto a dedicated VLAN or guest network so that credential exposure does not grant access to primary internal resources.

bash

# Configuration example: verify installed versions before pairing
# On Android, confirm DuoxMe version
adb shell dumpsys package com.fermax.duox | grep versionName

# On the monitor, confirm firmware version through the DuoxMe app
# Settings > Devices > [Monitor] > Firmware version
# Required: application >= 4.3.4 and firmware >= 01.50.001