CVE-2026-112165 · Other
NO FIX YET
The LaserGest mobile application turns off TLS certificate and hostname verification through setServerTrustMode("nocheck"). An attacker on the same network path can intercept or modify traffic, including credentials and API calls.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone using the LaserGest mobile app on a network an attacker could sit on, such as public Wi-Fi. The sources do not name affected versions or say whether a fixed release exists.
Not affected if unknown
Who cares laser-gest, mobile
Unknown from the sources.
No fix yet, per the sources.
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.