{"id":"CVE-2025-2909","aliases":["EUVD-2025-8619","GHSA-hfvj-w63f-mc9j"],"status":"published","title":"Lack of encryption vulnerability in DuoxMe","description":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00077,"percentile":0.00104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-312"],"published":"2025-03-28T12:51:54Z","modified":"2026-06-17T09:07:49Z","products":[{"vendor":"fermax","product":"duoxme ios application"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2909"},{"url":"https://github.com/advisories/GHSA-hfvj-w63f-mc9j"}],"sources":{"cve":[{"id":"CVE-2025-2909","title":"Lack of encryption vulnerability in DuoxMe","description":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.","status":"published","published":"2025-03-28T12:51:54.15Z","modified":"2025-03-28T13:47:34.455Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-8619","description":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.","status":"published","published":"2025-03-28T12:51:54Z","modified":"2025-03-28T13:47:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:48.15902Z"}],"ghsa":[{"id":"GHSA-hfvj-w63f-mc9j","title":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3...","description":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.","status":"published","published":"2025-03-28T15:31:55Z","modified":"2025-03-28T15:32:02Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T15:00:30.942475Z"}],"nvd":[{"id":"CVE-2025-2909","description":"The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.","status":"published","published":"2025-03-28T13:15:41.387Z","modified":"2026-06-17T09:07:49.923Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:10:56.494516Z"}]}}