CVE-2026-86474 in DUOX PLUS
Summary
by MITRE • 09/16/2026
The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified involves a critical failure in the transport layer security implementation within specific firmware of VEO and VEO-XS Wi-Fi baby monitors prior to version 01.48.001. The core technical flaw lies in the device's network stack, which fails to validate the X.509 certificates presented by the remote server during the download process for firmware updates. In a secure implementation, the client must verify that the certificate is signed by a trusted Certificate Authority, check its validity period, and ensure it matches the expected hostname. By omitting these validation steps, the device accepts any valid or even self-signed certificate without scrutiny, effectively disabling mutual authentication and integrity verification mechanisms designed to prevent unauthorized modification of data in transit.
This architectural deficiency creates a severe opportunity for man-in-the-middle attacks against the update channel. An attacker positioned on the same network segment or capable of intercepting traffic between the device and the update server can inject themselves into the communication stream without triggering any security alerts or connection failures within the monitor's software. Because the client does not verify the identity of the server, it will proceed to download firmware binaries from an adversary-controlled endpoint rather than the legitimate manufacturer's infrastructure. This allows the attacker to serve maliciously crafted firmware images that may contain backdoors, rootkits, or other persistent malware designed to compromise the device's operating system and gain full control over its hardware capabilities, including audio and video feeds.
The operational impact of this vulnerability extends beyond simple data interception, as it fundamentally undermines the integrity of the software supply chain for these IoT devices. Once a compromised firmware image is installed, the attacker gains persistent administrative access to the monitor. This can lead to unauthorized surveillance through live streaming or recording capabilities, potential pivoting into other networked devices if the monitor shares credentials or has additional exposed services, and the use of the device as part of a botnet for distributed denial-of-service attacks. Furthermore, because firmware updates are often performed with elevated privileges, successful exploitation grants the attacker deep system-level access that is difficult to remediate without flashing clean official firmware, which itself may be blocked if the update mechanism remains compromised or if the attacker has modified boot processes to prevent re-flashing.
From a classification perspective, this flaw aligns directly with CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information within an ATT&CK framework context related to Command and Control channels where integrity is not maintained. The lack of certificate pinning or strict validation represents a common misconfiguration in embedded systems development, often resulting from rushed release cycles or insufficient security testing during the design phase. To mitigate this risk, users must upgrade their devices to version 01.48.001 or later, where the vendor has implemented proper TLS handshake procedures including certificate chain verification and hostname validation. Additionally, network administrators should segment IoT devices on isolated VLANs with strict egress filtering to limit exposure to untrusted networks, reducing the attack surface available for man-in-the-middle positioning even if software vulnerabilities persist in older firmware versions.