CVE-2026-112164 · Other
NO FIX YET
The LaserGest mobile app encrypts stored assistance portal credentials with a hardcoded AES key and IV. An attacker who gets the application package can decrypt the saved credentials in cleartext.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
People who installed the LaserGest mobile app and saved assistance portal credentials in it. The sources do not say which versions are affected or whether a fix is available.
Not affected if credentials-not-stored
Who cares android, ios, laser-gest, mobile
Unknown from the sources.
No fix yet, per the sources.
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.