EUVD-2026-66228Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
Physical NFC proximity required (AV:P, PR:N); scope changes to LoRaWAN network infrastructure via key-enabled traffic decryption and frame forgery (S:C, I:H); availability limited to frame rejection rather than full device outage (A:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
Lifecycle Timeline
2DescriptionCVE.org
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.
AnalysisAI
Cleartext exposure of LoRaWAN cryptographic session keys through the NFC interface of Milesight IoT sensor devices enables a physically proximate unauthenticated attacker to retrieve NwkSKey, AppSKey, and D2D keys from any affected device via a trivial NFC read operation. With these keys, an adversary can decrypt all ABP-mode LoRaWAN traffic for the compromised device, forge both uplink and downlink frames with valid session keys, inject falsified sensor readings into network servers, issue supported device commands, and cause legitimate frames to be rejected by consuming frame counters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires unauthenticated physical proximity of approximately 10 cm to an affected Milesight device - the effective NFC communication range - with no network connectivity, credentials, or prior system access needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N) scoring 8.3 correctly reflects that physical proximity is the sole barrier, with no privileges, complexity, or user interaction otherwise required, and with high impact across confidentiality, integrity, and availability of the vulnerable system plus significant downstream integrity impact on the LoRaWAN network infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a commodity NFC-capable Android smartphone and a freely available NFC tag-reading application walks within approximately 10 cm of an affected Milesight sensor mounted in a building corridor or utility room. The NFC read operation completes in under one second with no authentication, yielding the device's LoRaWAN NwkSKey, AppSKey, and D2D keys in cleartext. … |
| Remediation | Consult the Milesight vulnerability advisory at https://www.milesight.com/legal/vulnerabilities-in-some-milesight-sensors for firmware updates; no specific patched firmware version number was confirmed from available data, so operators should monitor that page directly for release information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit physical security controls and access to all deployed Milesight IoT sensors and contact Milesight to identify affected device models and request guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Am102 102L V2
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today