CVE-2026-86474 — Improper Certificate Validation in the Firmware Download vulnerability

CVE-2026-86474

Improper Certificate Validation in the Firmware Download vulnerability PUBLISHED

Description (CNA)

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.

Affected (CNA)

Vendor / product	Versions
Fermax Electronica S.A.U. / DUOX PLUS monitor firmware (VEO Wi-Fi range)	affected 0 before 01.48.001

CWE

CWE-295

References

https://fermax.com/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.