A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affect…

published 2026-08-26 2 mo ago modified 2026-09-09 2 mo ago also EUVD-2026-66229

cvss: 7.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-08-26)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.3	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
CNA	3.1	7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA	4.0	8.3	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Milesight AM102/102L V2
Milesight AM103/103L V2
Milesight AM304L
Milesight AM305L
Milesight AM307 V2
Milesight AM308
Milesight AM308L
Milesight AM319
Milesight WS101
Milesight WS136
Milesight WS156
Milesight WS201
Milesight WS202
Milesight WS203
Milesight WS301
Milesight WS303
Milesight WS50X (2W-W11-EU) [501/502/503]
Milesight WS50X (3W-W11-EU) [501/502/503]
Milesight WS50X (3W-W12-EU) [501/502/503]
Milesight WS51X [513/515]
Milesight WS52X [523/525]
Milesight WS558
Milesight VS321
Milesight VS360
Milesight VS350 V3
Milesight VS351
Milesight VS330
Milesight VS340
Milesight VS341
Milesight VS370
Milesight GS301
Milesight EM300-TH V3
Milesight EM320-TH
Milesight TS201 V2
Milesight TS30x V2
Milesight WT201 V2
Milesight WT211 V2
Milesight UC501
Milesight UC502
Milesight UC511 V4
Milesight UC512 V4
Milesight UC521 LoRaWAN®
Milesight UC521 Cellular
Milesight EM300-DI
Milesight EM300-MCS V3
Milesight EM300-MLD V3
Milesight EM300-SLD V3
Milesight EM300-ZLD V3
Milesight EM320-TILT
Milesight EM400-TLD LoRaWAN®

Classification

Weakness

CWE-319 Cleartext Transmission of Sensitive Information

References

milesight.com /legal/vulnerabilities-in-some-milesight-sensors
vendor-advisory, mitigation

Sources

CVE List CVE-2026-29988
NVD CVE-2026-29988

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary