The DuoxMe Android application versions before 4.3.4 suffer from cleartext storage of sensitive information (CWE-312). This flaw enables an attacker who has local access to the device to extract credentials stored by the application. Exploitation requires local access and privileges, and no user interaction is needed. The vulnerability can lead to user account impersonation. There is no indication of known exploits in the wild. The CVSS 4.0 vector indicates low attack complexity, partial attack privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with local access and high privileges on the device can retrieve sensitive credentials stored in cleartext by the DuoxMe app, enabling user account impersonation. This compromises user confidentiality and integrity of the application’s authentication mechanism. The vulnerability does not require user interaction but does require local access and privileges.

A fixed version is available starting from 4.3.4. Users and administrators should upgrade the DuoxMe application to version 4.3.4 or later to remediate this vulnerability. No other mitigation guidance is provided. Patch status is confirmed by the affectedVersions field indicating versions prior to 4.3.4 are vulnerable.