NT OneAPP EUVD-2026-108006

Exploitation requires three concrete prerequisites: (1) local access to the device sufficient to invoke an Android ADB (Android Debug Bridge) backup of NT OneAPP; (2) the user actively authorizing and confirming the ADB backup on-device (reflected as UI:A in the CVSS vector); and (3) the ability to retrieve the resulting backup archive, which stores usernames and passwords in cleartext. Limiting factors that reduce real-world risk: there is no remote network vector (AV:L), ADB/USB debugging must be reachable, and the mandatory user confirmation of the backup prevents silent, fully automated extraction. Impact is confined to confidentiality of stored credentials.

This is a genuinely low-to-moderate real-world risk despite the 6.7 CVSS 4.0 score, which is tempered by a demanding local attack chain. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N) confirms a local attack vector requiring active user interaction (UI:A) and yielding high confidentiality impact only. Although PR:N technically denotes no authentication, exploitation realistically requires physical/ADB access to the device plus the victim explicitly authorizing and confirming an ADB backup - so the 'unauthenticated' label is accurate per the vector but materially gated by UI:A and the ADB prerequisite. No EPSS score, KEV listing, or POC indicator is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality-only impact (VI:N/VA:N) means no integrity or availability consequence. Net: this is a credential-exposure bug relevant to targeted device-access scenarios (lost/stolen/forensically-accessed phones or malicious-ADB situations), not a remotely wormable or mass-exploitable priority. EPSS/KEV/POC data are all absent rather than negative, so prioritization relies on the vector alone.

An attacker with physical or ADB access to a device running NT OneAPP persuades or waits for the user to approve an ADB backup, then extracts the generated backup archive. Because credentials are stored in cleartext (CWE-312), the attacker reads plaintext usernames and passwords directly from the backup data. No public exploit code is identified, and the attack requires both local access and user confirmation of the backup.