---
id: "CVE-2026-112165"
page: "https://infrastack.ai/live/CVE-2026-112165"
kind: "vulnerability"
aliases: ["CVE-2026-112165"]
title: "LaserGest mobile app skips TLS certificate checks, exposing traffic to interception"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["laser-gest", "mobile", "other"]
not_affected_if: ["unknown"]
published_at: "2026-11-09T17:17:09+00:00"
first_seen_at: "2026-11-09T17:27:38+00:00"
updated_at: "2026-11-09T17:28:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112165", "first_seen_at": "2026-11-09T17:27:38+00:00"}]
exploit_sources: []
---

# LaserGest mobile app skips TLS certificate checks, exposing traffic to interception

Link for people: https://infrastack.ai/live/CVE-2026-112165 (this .md is for agents)

The LaserGest mobile application turns off TLS certificate and hostname verification through setServerTrustMode("nocheck"). An attacker on the same network path can intercept or modify traffic, including credentials and API calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T17:27:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112165

## From the sources

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_