CVE-2026-86443: DuoxMe Android Information Disclosure Flaw

CVE-2026-86443 is an information disclosure vulnerability in DuoxMe for Android that stores credentials in cleartext, allowing attackers with local device access to steal user credentials and impersonate accounts. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-86443 Overview

CVE-2026-86443 is an insecure data storage vulnerability in the Fermax DuoxMe application for Android in versions prior to 4.3.4. The application stores user credentials in cleartext on the device. An attacker with local access to the device can retrieve these credentials and impersonate the legitimate user account. The weakness is categorized under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Local attackers can recover stored account credentials from the DuoxMe Android application and take over the associated user account, gaining unauthorized access to the video door entry system.

Affected Products

Fermax DuoxMe application for Android
Versions prior to 4.3.4
Android devices with the DuoxMe app installed

Discovery Timeline

2026-09-16 - CVE CVE-2026-86443 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86443

Vulnerability Analysis

The DuoxMe Android application persists user account credentials on the device without applying encryption or platform-provided secure storage. Any process or actor able to read the application's storage locations can extract these credentials in plaintext. Recovered credentials can then be replayed against the DuoxMe service to impersonate the legitimate account owner.

The vulnerability requires local access to the device, which limits remote mass exploitation. However, the impact once credentials are obtained is account takeover of the video intercom account tied to the resident. Exploitation scenarios include lost or stolen devices, shared devices, malicious apps with broad storage permissions, forensic analysis of backups, and post-compromise credential harvesting on rooted or debug-enabled devices.

Root Cause

The root cause is a failure to apply confidentiality controls to sensitive authentication material at rest. Android provides the Android Keystore system, EncryptedSharedPreferences, and file-based encryption APIs intended for this exact use case. The application instead writes credentials to standard preferences or files in a format that preserves the original values, matching the pattern described in CWE-312.

Attack Vector

An attacker with local access reads the app's private data directory or an unencrypted backup and parses the credential material. On a rooted device, or through Android Debug Bridge (adb) with run-as on debuggable builds, the private directory is directly reachable. On a non-rooted device, physical possession combined with a full backup or platform vulnerability can expose the same files. See the Fermax Security Advisories for vendor context.

No verified proof-of-concept code has been published for this vulnerability.
See the vendor advisory for technical details.

Detection Methods for CVE-2026-86443

Indicators of Compromise

Unexpected logins to a DuoxMe account from unfamiliar devices or IP addresses.
Presence of the DuoxMe application on rooted, jailbroken, or developer-mode Android devices in managed fleets.
Access to unencrypted Android backups (.ab files) that contain DuoxMe application data.
Installations of DuoxMe on Android at versions below 4.3.4.

Detection Strategies

Inventory managed Android devices and flag installations of DuoxMe where the version is lower than 4.3.4.
Monitor mobile device management (MDM) telemetry for root, jailbreak, and USB debugging status on devices with the DuoxMe app installed.
Alert on the DuoxMe account service for concurrent sessions from geographically inconsistent locations.

Monitoring Recommendations

Correlate authentication events for the DuoxMe service with device posture attributes exposed by the MDM.
Track application version drift and prioritize devices still running vulnerable versions of DuoxMe for remediation.
Review any historical Android backup artifacts stored in enterprise systems for DuoxMe preference files.

How to Mitigate CVE-2026-86443

Immediate Actions Required

Update the DuoxMe Android application to version 4.3.4 or later on all devices.
Force a credential reset for DuoxMe accounts used on devices that were previously rooted, shared, or lost.
Revoke active sessions on the DuoxMe service after upgrading to invalidate any credentials that may have been recovered.
Restrict installation of the vulnerable version through MDM application allowlists and minimum-version policies.

Patch Information

Fermax addresses the issue in DuoxMe for Android version 4.3.4. Users should install the update through the Google Play Store. Refer to the Fermax Security Advisories and the NVD entry for CVE-2026-86443 for authoritative version guidance.

Workarounds

Avoid installing DuoxMe on rooted, jailbroken, or shared Android devices until patched.
Disable USB debugging and full backups on devices running the vulnerable version.
Enforce device-level encryption and a strong screen lock to raise the bar for local extraction.
Uninstall the application on devices that cannot be updated and rely on alternative access methods.

bash

# Verify installed DuoxMe version via adb and remove vulnerable builds
adb shell pm list packages | grep -i duox
adb shell dumpsys package com.fermax.duox | grep versionName

# Uninstall the vulnerable application if update to 4.3.4+ is not possible
adb uninstall com.fermax.duox