NT OneAPP developed by NewType Infortech contains a vulnerability that allows unauthenticated local attackers to expose plaintext usernames and passwords stored in backup data. This can lead to the compromise of user accounts and system access if backup passwords are reused or exposed elsewhere. The weakness is a cleartext storage flaw as identified by CWE-312.

The vulnerable product is NewType Infortech's NT OneAPP. Any deployed instance running a version earlier than 1.5.35 is affected, as the patch released in 1.5.35 resolves the issue. The product lacks a currently specified version range, so organizations should assess whether they run older builds.

The advisory assigns a CVSS score of 6.7, indicating moderate to high severity, while no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The described attack requires local access and user confirmation of an ADB backup, meaning the threat is limited to machines with physical or local network access. Nonetheless, the exposure of credentials makes it a significant risk to confidentiality.