【Vulnerability Alert】NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Two Critical Security Vulnerabilities
publish date :
2026-11-06
update date :
2026-11-06
Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026102702101717 | Publication Time | 2026-10-27 14:18:18 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-27 14:18:18 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Two Critical Security Vulnerabilities |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000034 The NT OneAPP Enterprise Cloud Management System developed by NewType Infortech has five security vulnerabilities, two of which are critical security vulnerabilities: 【NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Hard-coded Credentials】(CVE-2026-114219, CVSS 4.x: 9.1) An unauthenticated remote attacker can obtain the hard-coded encryption key and decrypt the contents of login requests, thereby obtaining users' plaintext usernames, passwords, and device information. 【NewType Infortech｜NT OneAPP Enterprise Cloud Management System - Improper Certificate Validation】(CVE-2026-114220, CVSS 4.x: 9.3) An unauthenticated attacker on an adjacent network can exploit the application's failure to validate the server certificate and hostname to conduct a man-in-the-middle attack, thereby intercepting or tampering with communications between the application and the server. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] NT OneAPP Enterprise Cloud Management System version V1.5.22 and earlier (including V1.5.22) |
|||
| [Recommended Actions] 【CVE-2026-114219, CVE-2026-114220, CVE-2026-114223】 Update to NT OneAPP version V1.5.35 or later (including V1.5.35) 【CVE-2026-114221, CVE-2026-114222】 Update to NT OneAPP version V1.5.35 or later (including V1.5.35) |
|||
|
[Reference] |
|||
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer:
Computer Center