CVE-2026-86443CWE-312

CVE-2026-86443

published September 16, 2026

CVSS
6.9
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00104 · 1.0th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-09-16T14:16Z
References (2)
https://fermax.com/security-advisories · 539080bd-5750-4cce-b30b-eed9a4ef6dcchttps://nvd.nist.gov/vuln/detail/CVE-2025-2909 · 539080bd-5750-4cce-b30b-eed9a4ef6dcc
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 16 SEP 09:12Z
    Cleartext Storage of Sensitive Information Vulnerability
    cvelistv5