Man-in-the-Middle Vulnerability in LaserGest Mobile Application by LaserGest Inc.
CVE-2026-112165

6.9MEDIUM

Key Information:

Vendor

Laservideo

Status
Lasergest
Vendor
CVE Published:
9 November 2026

What is CVE-2026-112165?

The LaserGest mobile application has a flaw that disables TLS certificate and hostname verification, utilizing the setServerTrustMode("nocheck") method. This vulnerability exposes users to potential man-in-the-middle attacks, allowing malicious actors to intercept or manipulate network traffic, including sensitive data such as credentials and API communications. Attackers can exploit this security weakness to compromise the integrity and confidentiality of user information.

Affected Version(s)

lasergest iOS 1.0.18

References

https://github.com/livieromarco/security-advisories/blob/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Liviero Marco
CSIRT-IT
.