CVE-2025-2909 - CVE House

Status published Medium CVE-2025-2909

Lack of encryption vulnerability in DuoxMe

6.9 CVSS

Vulnerability Description

The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2909

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Fermax cybersecurity team

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications

More from Fermax

View All →

CVE-2025-2911

Improper Restriction of Excessive Authentication Attempts vulnerability in MeetMe products

Medium 5.3

CVE-2025-2910

User enumeration vulnerability in MeetMe products

Medium 6.9

CVE-2025-2908

Insufficiently Protected Credentials vulnerability in MeetMe products

High 8.5

Affected Vendor

Fermax

View all reports →

Affected Software

DuoxMe iOS application

Vulnerable Versions:

Timeline

Official Publish: March 28th, 2025

Last Modified: March 28th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System

Collection

T1552 Unsecured Credentials

Credential Access

T1530 Data from Cloud Storage