CVE-2025-2909CWE-312

Lack of encryption vulnerability in DuoxMe

Medium · published March 28, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00077 · 0.1th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2025-03-28T12:51Z
EPSS history
Timeline
  • 28 MAR 12:51Z
    Lack of encryption vulnerability in DuoxMe
    cvelistv5