Ws156
Monthly
Cleartext exposure of LoRaWAN cryptographic session keys via NFC interface in dozens of Milesight IoT sensor and controller models allows any physically proximate unauthenticated attacker to retrieve ABP NwkSKey, AppSKey, and D2D keys through a commodity NFC read operation. The stolen keys enable full compromise of LoRaWAN communications for the affected device, including decryption of captured traffic, forgery of uplink and downlink frames with valid message integrity codes, injection of falsified sensor data, issuance of device commands, and disruption of legitimate frame processing. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the attack itself requires no technical sophistication once physical proximity is achieved.
Cleartext exposure of LoRaWAN cryptographic session keys through the NFC interface of Milesight IoT sensor devices enables a physically proximate unauthenticated attacker to retrieve NwkSKey, AppSKey, and D2D keys from any affected device via a trivial NFC read operation. With these keys, an adversary can decrypt all ABP-mode LoRaWAN traffic for the compromised device, forge both uplink and downlink frames with valid session keys, inject falsified sensor readings into network servers, issue supported device commands, and cause legitimate frames to be rejected by consuming frame counters. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, but the attack requires no credentials and succeeds in seconds with commodity NFC hardware against any physically accessible affected device.
Cleartext exposure of LoRaWAN cryptographic session keys via NFC interface in dozens of Milesight IoT sensor and controller models allows any physically proximate unauthenticated attacker to retrieve ABP NwkSKey, AppSKey, and D2D keys through a commodity NFC read operation. The stolen keys enable full compromise of LoRaWAN communications for the affected device, including decryption of captured traffic, forgery of uplink and downlink frames with valid message integrity codes, injection of falsified sensor data, issuance of device commands, and disruption of legitimate frame processing. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the attack itself requires no technical sophistication once physical proximity is achieved.
Cleartext exposure of LoRaWAN cryptographic session keys through the NFC interface of Milesight IoT sensor devices enables a physically proximate unauthenticated attacker to retrieve NwkSKey, AppSKey, and D2D keys from any affected device via a trivial NFC read operation. With these keys, an adversary can decrypt all ABP-mode LoRaWAN traffic for the compromised device, forge both uplink and downlink frames with valid session keys, inject falsified sensor readings into network servers, issue supported device commands, and cause legitimate frames to be rejected by consuming frame counters. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, but the attack requires no credentials and succeeds in seconds with commodity NFC hardware against any physically accessible affected device.