CVE-2025-2909 Lack of encryption vulnerability in DuoxMe
An attacker can access sensitive information by exploiting the lack of encryption in the DuoxMe iOS application binary.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2909?
CVE-2025-2909 is a medium-severity vulnerability in Fermax DuoxMe iOS application, published on 28 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.
Weakness: CWE-312
Which versions are affected by CVE-2025-2909?
How do I fix CVE-2025-2909?
No fix has been published for CVE-2025-2909 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2909 being exploited?
There is no known exploitation of CVE-2025-2909 in the wild and no public exploit code.
Sources
Also known as GHSA-hfvj-w63f-mc9j.