Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026102702101717 | Publication Time | 2026-10-27 14:18:18 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-27 14:18:18 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Two Critical Security Vulnerabilities |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000034 The NT OneAPP Enterprise Cloud Management System developed by NewType Infortech has five security vulnerabilities, two of which are critical security vulnerabilities: 【NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Hard-coded Credentials】(CVE-2026-114219, CVSS 4.x: 9.1) An unauthenticated remote attacker can obtain the hard-coded encryption key and decrypt the contents of login requests, thereby obtaining users' plaintext usernames, passwords, and device information. 【NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Improper Certificate Validation】(CVE-2026-114220, CVSS 4.x: 9.3) An unauthenticated attacker on an adjacent network can exploit the application's failure to validate the server certificate and hostname to conduct a man-in-the-middle attack, thereby intercepting or tampering with communications between the application and the server. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] NT OneAPP Enterprise Cloud Management System version V1.5.22 and earlier (including V1.5.22) |
|||
| [Recommended Actions] 【CVE-2026-114219, CVE-2026-114220, CVE-2026-114223】 Update to NT OneAPP version V1.5.35 or later (including V1.5.35) 【CVE-2026-114221, CVE-2026-114222】 Update to NT OneAPP version V1.5.35 or later (including V1.5.35) |
|||
|
[Reference] |
|||