NCL Door Access CVE-2026-75907

Exploitation requires physical/NFC proximity to a legitimate credential: the attacker must be close enough (typically a few centimeters) to skim the static 7-byte UID from a victim's NTAG212 chip, then must physically present the cloned credential at a Norwegian Cruise Line door reader. The limiting factors are (1) physical access to both the target credential and the door, and (2) the credential using an NTAG212 with no challenge-response - the flaw is inherent to the access-control design, so it affects the deployed system by default rather than a toggled configuration. The CVSS AV:N (network) metric overstates reachability; realistic exploitation is proximity-based, not remote.

The vendor/NVD CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is internally inconsistent with the described vulnerability and should be treated with skepticism. The flaw is that a shipboard door access control authenticates solely on the static, cleartext 7-byte UID of an NTAG212 NFC chip - a manufacturer serial number that is trivially readable and clonable. This is fundamentally a proximity/physical attack, not a network one: an attacker must NFC-read a legitimate credential (centimeter-range) and then present a cloned card at a physical door. The AV:N (network) metric is therefore almost certainly wrong - this should be AV:P or AV:A. Likewise the impact modeling is questionable: the real consequence is unauthorized physical entry (an integrity/access-control failure, arguably I:H), yet the vector reports C:H/I:N/A:N. On real-world signals: no EPSS score, no CISA KEV listing, and no public POC are provided, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net assessment: despite the 7.5 'High' label, this is a low-urgency, single-organization physical-security design weakness rather than a scalable remote threat - the network vector inflates the score. Verify the true attack vector with CERT/CC (VU#676317), as CVSS indicates network access but the description clearly implies physical/NFC proximity.

An attacker discreetly reads the cleartext UID of a passenger's or crew member's NTAG212 keycard using a cheap handheld NFC reader while in close proximity, then writes that UID to a blank/emulator NFC card. Presenting the clone at the door reader grants entry because the system only checks the static UID and has no challenge-response. No public exploit code is required - UID cloning is a well-known, commodity NFC technique.