NT OneAPP CVE-2026-114220

Exploitation requires the attacker to hold a man-in-the-middle position on the network path between the NT OneAPP client and its backend server - the description specifies 'network-adjacent' access (e.g. same LAN/Wi-Fi segment, rogue access point, or ARP/DNS/router compromise), not arbitrary internet-remote reach. The flaw triggers because the client omits both server-certificate and hostname validation, so no special product configuration or feature toggle is needed; it affects the application's default TLS handling. Limiting factors: the attacker must already intercept live traffic (a non-trivial prerequisite that bounds mass exploitation), and impact is confined to sessions the attacker can physically/logically reach; no authentication or user interaction is required once positioned.

This is a CWE-295 Improper Certificate Validation flaw enabling man-in-the-middle attacks against NT OneAPP. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.3 Critical, but this conflicts with the description, which explicitly states 'network-adjacent attackers' - adjacency implies AV:A, not AV:N, and MITM positioning is rarely AC:L. This discrepancy inflates the headline score: a true MITM requires the attacker to already occupy a privileged network path (shared LAN/Wi-Fi, rogue AP, ARP/DNS spoofing, or compromised upstream), which is a meaningful real-world barrier the AV:N/AC:L rating understates. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuinely serious confidentiality/integrity bug, but real-world priority is tempered by the required adjacent position and the obscure, low-footprint product - treat as a patch-when-available item rather than an emergency, and verify the attack vector (adjacent vs. network) with the vendor/TWCERT advisory.

An attacker on the same local network segment as a victim (e.g. shared corporate Wi-Fi or a compromised router) positions themselves between the NT OneAPP client and its server. Because the app fails to validate the server certificate and hostname, the attacker presents a forged or self-signed certificate that the client silently accepts, then transparently intercepts and modifies the traffic. No public exploit code is identified; the attack requires an existing adjacent/MITM foothold rather than purely remote reach.