CVE-2026-112165
Received Received - Intake

LaserGest Mobile App TLS Certificate Verification Bypass

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: ENISA

Description
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-112165
EUVD
EUVD-2026-120096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
laservideo lasergest 1.0.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112165 is a vulnerability in the LaserGest mobile app where TLS certificate and hostname verification are disabled using setServerTrustMode("nocheck"). This allows attackers to intercept or modify network traffic, including credentials and API communications, without needing to install a trusted certificate on the device.

Detection Guidance

Check for the use of setServerTrustMode("nocheck") in the LaserGest app code or network traffic. Inspect Android app binaries for the CordovaServerTrust class or Silkimen HTTP plugin. Monitor for unencrypted API communications or unexpected certificate errors being ignored.

Impact Analysis

An attacker in a position to intercept traffic could impersonate the server, read or alter sensitive data like usernames and passwords during login, and manipulate API responses. This could expose business information or enable unauthorized actions.

Compliance Impact

This vulnerability likely violates compliance requirements for secure data transmission, such as GDPR's encryption standards and HIPAA's safeguards for protected health information, due to the lack of proper TLS validation exposing sensitive data.

Mitigation Strategies

Remove all instances of setServerTrustMode("nocheck") from the app. Restore standard TLS certificate-chain and hostname verification. Update the app to a patched version if available. Block network interception attempts by ensuring secure network configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...