CVE-2026-114220: NT OneAPP Improper Certificate Validation Enables Man-in-the-Middle (CVSS 9.1)

Executive Summary

CVE-2026-114220 is an improper certificate validation flaw (CWE-295) in NT OneAPP, a product from Taiwan-based NewType Infortech. The application does not validate the server certificate or the hostname when it connects to its server. An unauthenticated attacker on the same network segment can therefore perform a man-in-the-middle (MITM) attack, reading or modifying traffic between the application and the server.

The CVE was assigned by Taiwan CERT (TWCERT) and published to the NVD on 2026-10-22.

Vulnerability Details

TLS only protects a connection when the client checks that the certificate presented is trusted and that it was issued for the host being contacted. NT OneAPP skips both checks. Any certificate, including a self-signed one generated by an attacker, is accepted.

Attack Flow

1. Attacker gains a position on the same network as the victim device
   (rogue Wi-Fi access point, ARP/DNS spoofing, compromised switch)
2. Victim device starts a session with the NT OneAPP server
3. Attacker answers with their own certificate
4. The app accepts it without validation
5. Attacker reads or alters credentials, tokens and data in transit

Other NT OneAPP CVEs were published alongside this one (for example CVE-2026-114221 and CVE-2026-114222, covering credential-handling and authentication problems), so the product warrants a broader review.

Scoring Notes

Public trackers disagree on severity. The CVSS 3.1 base score is 9.1, while some third-party scoring rates the practical risk lower because exploitation needs a network-adjacent position. As of 2026-10-22 the CVE is not in CISA KEV, no public exploit has been tracked, and EPSS is about 0.2%.

Affected Scope

Note: Trackers differ on the fixed version. Confirm against the TWCERT advisory and the vendor before relying on a specific build number.

Remediation

1. Update NT OneAPP to the latest vendor release (one source reports 1.5.35 or later contains the fix)
2. Avoid untrusted networks such as public Wi-Fi when using affected versions
3. Segment management traffic so the app and its server are not reachable from user or guest VLANs
4. Rotate credentials that were used through the app on shared or untrusted networks
5. Monitor for unexpected certificates or ARP/DNS anomalies on networks where NT OneAPP clients operate

Key Takeaways

1. CVSS 9.1 but limited to a network-adjacent attacker position
2. No certificate or hostname validation means any TLS certificate is trusted
3. Update and review the related NT OneAPP CVEs published the same day
4. No known exploitation at publication time

References

• NVD — CVE-2026-114220
• VulDB — CVE-2026-114220
• TWCERT advisory