EUVD-2026-66229
GHSA-x7rj-767c-4728
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical NFC read requires no credentials; scope changes to C because stolen keys compromise the broader LoRaWAN network server and application-layer data consumers beyond the device itself.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.
AnalysisAI
Cleartext exposure of LoRaWAN cryptographic session keys via NFC interface in dozens of Milesight IoT sensor and controller models allows any physically proximate unauthenticated attacker to retrieve ABP NwkSKey, AppSKey, and D2D keys through a commodity NFC read operation. The stolen keys enable full compromise of LoRaWAN communications for the affected device, including decryption of captured traffic, forgery of uplink and downlink frames with valid message integrity codes, injection of falsified sensor data, issuance of device commands, and disruption of legitimate frame processing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical proximity of approximately 10 cm or less to the affected device is the sole technical requirement - no network access, credentials, or software vulnerability exploitation is involved. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 reflects high impact across confidentiality, integrity, and availability on both the vulnerable device and the downstream LoRaWAN network (SI:H for subsequent system integrity), but the physical access vector (AV:P) is a genuine and significant real-world mitigating factor that the raw score does not fully convey. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker visits a location where Milesight LoRaWAN sensors are deployed - a smart office building, agricultural monitoring site, or municipal infrastructure installation - and holds a commodity NFC-capable mobile phone or a sub-$20 USB NFC reader within centimeters of any affected sensor for less than a second. The NFC read returns the device's NwkSKey and AppSKey in plaintext, which the attacker then loads into freely available LoRaWAN tools (such as ChirpStack's packet forger or open-source LoRa sniffer software) to decrypt all previously captured traffic and construct frames that the LoRaWAN network server accepts as authentic, enabling silent injection of falsified temperature, occupancy, or environmental data into downstream building management or industrial control systems. … |
| Remediation | Consult the Milesight vendor advisory at https://www.milesight.com/legal/vulnerabilities-in-some-milesight-sensors for firmware updates; no specific fixed firmware version number is independently confirmed from available data, so the vendor advisory is the definitive source for patch versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Milesight IoT sensors and controllers, identify affected models, and restrict physical facility access to areas housing these devices; brief operations and facilities teams on the threat. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Am102 102L V2
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today