Incibe-Cert

**Name of the Vulnerable Software and Affected Versions** DuoxMe application versions prior to 4.3.4 VEO and VEO-XS Wi-Fi monitor firmware versions prior to 01.50.001 **Description** Home Wi-Fi credentials are transmitted without encryption during the pairing process between the DuoxMe application and VEO or VEO-XS Wi-Fi monitors. This allows an attacker positioned on the Wi-Fi Direct network to intercept the network password. **Recommendations** Update the DuoxMe application to version 4.3.4 or later. Update VEO and VEO-XS Wi-Fi monitor firmware to version 01.50.001 or later.

**Name of the Vulnerable Software and Affected Versions** DuoxMe versions prior to 4.3.4 **Description** Sensitive information is stored in cleartext within the application. This allows an attacker with local access to the device to retrieve stored credentials and impersonate the user account. **Recommendations** Update to version 4.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** VEO Wi-Fi monitors versions prior to 01.48.001 VEO-XS Wi-Fi monitors versions prior to 01.48.001 **Description** The software fails to validate TLS certificates during the firmware update download process. This flaw enables a man-in-the-middle attack, where an attacker intercepts the communication channel to potentially deliver malicious firmware. **Recommendations** Update VEO Wi-Fi monitors to version 01.48.001 or later. Update VEO-XS Wi-Fi monitors to version 01.48.001 or later.

**Name of the Vulnerable Software and Affected Versions** VEO Wi-Fi monitors versions prior to 01.48.001 VEO-XS Wi-Fi monitors versions prior to 01.48.001 **Description** The software fails to verify the digital signatures of firmware update packages. This allows an attacker who can control the update delivery process to install unauthorized firmware on the device. **Recommendations** Update VEO Wi-Fi monitors to version 01.48.001 or later. Update VEO-XS Wi-Fi monitors to version 01.48.001 or later.