NT OneAPP: Improper certificate validation allows man-in-the-middle attacks
Summary
NT OneAPP does not properly validate server certificates and hostnames. An attacker in a man-in-the-middle position on the network path can intercept or modify communication between the app and its server. No authentication is required, but the attacker must be able to sit on the traffic path, for example on a shared or hostile network.
Affected
- NewType Infortech NT OneAPP up to and including 1.5.22
- The CNA record uses "0" as the lower bound, which is a placeholder and not a real first version.
Fixed in
- Update to NT OneAPP version 1.5.35 or later, as stated in the CNA record.
- The TWCERT/CC advisory could not be verified, so confirm the fixed version with the vendor.
Workaround
- Unknown. No vendor-published workaround was found.
- Until a fix is confirmed, avoid using the app on untrusted Wi-Fi or other networks where traffic can be intercepted.
Exploitation
- Not known to be exploited. The app is not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept or exploit code was found.
Our recommendation
- Check whether NT OneAPP is used in your environment.
- Request the patched version (1.5.35 or later, to be confirmed) from the vendor and apply it.
- Restrict use of the app to trusted networks until the update is installed.
- Recheck the NVD record once analysis is complete, because severity scores differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TWCERT/CC TVN advisory (English) www.twcert.org.tw
- TWCERT/CC TVN advisory (Chinese) www.twcert.org.tw
- Vulners CVE record vulners.com
- VulDB entry 425180 vuldb.com
- HOL Guard CVE summary hol.org
- CVEtodo CVE page cvetodo.com
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:56.
Original description (NVD)
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.