{"id":"CVE-2026-114220","published":"2026-10-22T05:16:50.020","lastModified":"2026-10-22T19:17:37.153","description":"NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html","tags":[]},{"url":"https://www.twcert.org.tw/tw/cp-132-11298-d9dd5-1.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The NT OneAPP application fails to validate server certificates and hostnames, allowing unauthenticated, network-adjacent attackers to perform man-in-the-middle attacks and intercept or modify traffic.","exploitability":"Exploitation requires network adjacency and no authentication; it is straightforward for an attacker in position to intercept traffic between the app and server.","blast_radius":"Attackers can steal sensitive data, tamper with commands or responses, and potentially escalate to full system compromise depending on the application’s functionality.","remediation":"Upgrade to NT OneAPP version 2.590 or later, where certificate and hostname validation has been properly implemented.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["mitm","tls-validation","certificate-validation","web","ics"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:51:25.722Z"}}