CVE-2026-86474: Improper Certificate Validation in the Firmware Download vulnerability
The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VEO and VEO-XS Wi-Fi monitorsto a version that resolves this vulnerability.Fixed in 01.48.001 - Compensating control
If immediate firmware upgrade is not possible, mitigate man-in-the-middle risk on the firmware update channel (e.g., restrict update traffic/network paths so attackers cannot intercept or alter firmware downloads).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to act as a man-in-the-middle on the device's firmware update channel, allowing them to interfere with firmware downloads.
Which devices and versions are affected?
VEO and VEO-XS Wi-Fi monitors are affected when running firmware versions earlier than 01.48.001.