| TVN ID | TVN-202610006 |
|---|---|
| CVE ID | CVE-2026-114219, CVE-2026-114220, CVE-2026-114221, CVE-2026-114222, CVE-2026-114223 |
| CVSS | 【CVE-2026-114219】 9.1 (Critical) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N 7.4 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 【CVE-2026-114220】 9.3 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N 9.1 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 【CVE-2026-114221】 5.9 (Medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 7.4 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N 【CVE-2026-114222】 6.9 (Medium) CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 6.2 (Medium) CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 【CVE-2026-114223】 6.7 (Medium) CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 5.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| Affected Products | NT OneAPP version 1.5.22 and earlier |
| Description | 【CVE-2026-114219(Hard-coded Credentials)】 Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information. 【CVE-2026-114220(Improper Certificate Validation)】 Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server. 【CVE-2026-114221(Credential Disclosure)】 Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user. 【CVE-2026-114222(Authentication Bypass)】 Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user. 【CVE-2026-114223(Exposure of Sensitive Information)】 Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure. |
| Solution | Update to NT OneAPP version 1.5.35 or later |
| Credit | Chiao-Lin Yu |
| Public Date | 2026-10-22 |
:::