CVE-2026-85628 in DuoxMe
Summary
by MITRE • 09/16/2026
Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified involves a critical flaw in the secure pairing mechanism between the DuoxMe mobile application and VEO or VEO-XS home security cameras. Specifically, during the initial configuration process where users connect their devices to a local Wi-Fi network, the application transmits the SSID and password of the target wireless network to the camera hardware without applying any form of encryption or integrity protection. This design oversight means that the credentials are sent in plaintext over the air interface used for device-to-device communication, which typically relies on Wi-Fi Direct technology. Because this transmission occurs before a secure channel is established between the app and the device, it leaves the sensitive authentication data exposed to passive eavesdropping by any entity capable of monitoring traffic on that specific network segment.
An attacker positioned within range of the Wi-Fi Direct connection can exploit this lack of encryption through standard wireless sniffing techniques. By utilizing tools such as packet analyzers or specialized radio frequency interception software, a malicious actor can capture the raw data packets exchanged during the pairing phase. Since the credentials are not encrypted, the attacker does not need to perform complex cryptographic attacks to decipher them; they simply need to observe and record the transmission. Once captured, these plaintext Wi-Fi credentials allow the attacker to join the victim's home network with full administrative privileges equivalent to those of a legitimate user who performed the setup. This represents a severe compromise of confidentiality, as it bypasses all intended security controls designed to protect network access keys from unauthorized disclosure.
The operational impact of this vulnerability is significant and extends beyond the immediate loss of Wi-Fi credentials. With access to the home network, an attacker can potentially intercept unencrypted traffic from other devices on the same LAN, including smart home appliances, computers, and mobile phones that may not have their own robust security measures in place. This could lead to further lateral movement within the local network, allowing for data exfiltration, man-in-the-middle attacks against internal services, or even control over IoT devices such as cameras, locks, and thermostats. The attack vector is classified under CWE-319, which describes cleartext transmission of sensitive information, highlighting a fundamental failure in applying the principle of least privilege and secure data handling during critical configuration steps. Furthermore, this behavior aligns with ATT&CK technique T1048, specifically Exfiltration Over Alternative Protocol, as it involves stealing credentials via non-standard or unencrypted channels to gain unauthorized access.
To mitigate this risk, users must upgrade the DuoxMe application to version 4.3.4 or later and ensure that their VEO or VEO-XS monitor firmware is updated to version 01.50.001 or higher. These updates implement proper encryption protocols for all data exchanged during the pairing process, ensuring that Wi-Fi credentials are protected against interception even if an attacker is monitoring the local wireless traffic. Until such patches are applied, it is advisable to perform device setup in a secure environment where physical proximity and network access are strictly controlled by trusted individuals only. Additionally, enabling WPA3 encryption on the home router can provide an additional layer of protection for other devices, although it does not fully mitigate the risk posed during the initial unencrypted pairing phase if older security standards like WPA2 or WEP are still in use.