CVE-2025-2909
Lack of encryption vulnerability in DuoxMe
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 28, 2025
- Updated
- Mar 28, 2025
- Reserved
- Mar 28, 2025
Description
The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | INCIBE |
Weaknesses
- CWE-312 Cleartext Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
DuoxMe iOS applicationFermax |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.