CVE-2026-114223
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
NT OneAPP developed by NewType Infortech has an exposure of sensitive information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.
Risk Assessment
Disclosure of plaintext credentials can allow an attacker to take over accounts and gain further access to organizational systems. The risk applies to devices where application backups are stored.
Recommendation
Restrict access to ADB backups and update the application to a version that does not store sensitive data in plaintext. Consider encrypting backups and reviewing who has permission to create them.
Other vulnerabilities in NT OneAPP
See all- CVE-2026-114220Critical
NT OneAPP by NewType Infortech has an improper certificate validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack because the application fails to validate the server certificate and hostname, intercepting or modifying communications between the application and the server.
- CVE-2026-114222Medium
NT OneAPP by NewType Infortech contains an authentication bypass vulnerability. An unauthenticated local attacker can bypass the App PIN lock mechanism via a Deep Link and access protected resources of a logged-in user.
- CVE-2026-114221High
NT OneAPP by NewType Infortech has a credential disclosure vulnerability. Under specific conditions, an unauthenticated remote attacker can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView, obtaining the NUP Portal passcode of a logged-in user.
- CVE-2026-114219High
NT OneAPP by NewType Infortech contains a hard-coded credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
Original NVD description (English source)
NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS