{"id":"CVE-2026-114220","kind":"vulnerability","aliases":["CVE-2026-114220"],"related":[],"title":"NT OneAPP: missing certificate checks let attackers intercept app traffic","description":"NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.","summary":"NT OneAPP versions up to 1.5.22 do not validate the server certificate or hostname, so the app accepts a fake server. An attacker on the same network path can read and change the traffic between the app and its server.","severity":"critical","cvss":9.3,"epss":0.00158,"exploited":false,"exploited_at":null,"products":[{"name":"NT OneAPP","fixed":["1.5.35"],"affected":"<= 1.5.22","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","enterprise","ios","mitm","mobile","newtype-infortech","nt-oneapp","other","tls"],"not_affected_if":["version-1.5.35-or-later"],"how_to_check":"Open NT OneAPP on the phone (iOS or Android), check the version in the app or store listing; 1.5.22 or earlier is affected. For fleets, check MDM app inventory for bundle tw.com.newtype.ntoneapp (Android package ID).","fix":"Update NT OneAPP to version 1.5.35 or later.","status":"open","published_at":"2026-10-22T05:16:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:36+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:36Z","model":"claude-haiku-5-5","output":{"fix":"Update NT OneAPP to version 1.5.35 or later.","reach":"network","title":"NT OneAPP: missing certificate checks let attackers intercept app traffic","impact":"high","summary":"NT OneAPP versions up to 1.5.22 do not validate the server certificate or hostname, so the app accepts a fake server. An attacker on the same network path can read and change the traffic between the app and its server.","category":"other","who_cares":["nt-oneapp","mobile","android","ios"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads and modifies app traffic, including any credentials it sends.","analyst_note":"Confirm which platforms (Android, iOS, desktop) are affected and whether the app is distributed to users or internal staff; check the NVD entry for the CVSS vector.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-1.5.35-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2970,"output_tokens":363,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which platforms (Android, iOS, desktop) are affected and whether the app is distributed to users or internal staff; check the NVD entry for the CVSS vector.","search":"'-114220':13A,16A '-2026':12A,15A '1.5.22':37B 'accept':49B 'adjac':87C 'android':19B 'app':9A,48B,68B 'applic':115C 'attack':7A,54B,88C,97C 'certif':4A,43B,81C,104C 'chang':63B 'check':5A 'communic':112C 'cve':11A,14A 'develop':74C 'enterpris':20B 'fail':99C 'fake':51B 'hostnam':45B,107C 'improp':80C 'infortech':26B,77C 'intercept':8A,109C 'io':21B 'let':6A 'man':93C 'man-in-the-middl':92C 'middl':96C 'miss':3A 'mitm':22B 'mobil':23B 'modifi':111C 'network':58B,86C 'network-adjac':85C 'newtyp':25B,76C 'newtype-infortech':24B 'nt':1A,17A,28B,32B,72C 'nt-oneapp':27B 'oneapp':2A,18A,29B,33B,73C 'path':59B 'perform':90C 'read':61B 'server':42B,52B,71B,103C,118C 'therebi':108C 'tls':31B 'traffic':10A,65B 'unauthent':84C 'valid':40B,82C,101C 'version':34B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T05:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114220","severity":null,"published_at":"2026-10-22T05:16:50+00:00","modified_at":"2026-10-22T19:17:37+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114220:215","url":null,"severity":null,"published_at":"2026-10-23T22:24:03+00:00","modified_at":"2026-10-23T22:24:03+00:00","first_seen_at":"2026-10-23T22:24:03+00:00","fetched_at":"2026-10-23T22:24:03+00:00","note":"TWCERT/CC TVN-202610006 (primary, Taiwan CNA) gives affected <=1.5.22, fix 1.5.35+. Advisory does not say which traffic is affected beyond app-to-server communications; no public PoC or exploitation found; no social search done (obscure product)."},{"source":"analyst","external_id":"CVE-2026-114220:304","url":null,"severity":null,"published_at":"2026-10-23T22:48:25+00:00","modified_at":"2026-10-23T22:48:25+00:00","first_seen_at":"2026-10-23T22:48:25+00:00","fetched_at":"2026-10-23T22:48:25+00:00","note":"Follow-up on triage question: app is on App Store (iOS 15+) and Google Play (tw.com.newtype.ntoneapp), enterprise-only (employees of NewType customers that bought its modules, per store listings). TWCERT does not say whether both platforms are affected; the advisory only says 'NT OneAPP 1.5.22 and earlier', so assume both until the vendor says otherwise. No desktop client found. CVSS from CVE record: 4.0 9.3 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H; 3.1 9.1. Store version numbers may differ per platform."},{"source":"epss","external_id":"CVE-2026-114220","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114220","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1418,"url":"https://www.twcert.org.tw/en/cp-139-11306-e1a39-2.html","title":"TWCERT/CC TVN-202610006: NewType Infortech NT OneAPP - 5 Vulnerabilities","kind":"advisory","source":"analyst","text":"Affected: NT OneAPP 1.5.22 and earlier. Solution: update to NT OneAPP 1.5.35 or later. CVE-2026-114221 (Credential Disclosure): unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, obtaining the NUP Portal passcode of a logged-in user. Credit: Chiao-Lin Yu. Public 2026-10-22.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1425,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114220","title":"CVE Record CVE-2026-114220","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1609,"url":"https://apps.apple.com/tw/app/nt-oneapp/id1443990412","title":"NT OneAPP on the App Store (iOS 15+)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1610,"url":"https://play.google.com/store/apps/details?hl=es_PY&id=tw.com.newtype.ntoneapp","title":"NT OneAPP on Google Play (tw.com.newtype.ntoneapp)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}