Riskcovery

CVE-2026-29988

State
Published
Severity
8.3 High
Published
Aug 26, 2026
Updated
Aug 26, 2026
Reserved
Mar 4, 2026

Read the record on cve.org

Description

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.

Scores

CVSSScoreVectorSource
4.08.3 HighCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:Nmitre
3.17.6 HighCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hmitre

Weaknesses

  • CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

ProductVersions
AM102/102L V2Milesight
  • 1.4 and earlierAffected
AM103/103L V2Milesight
  • 1.8 and earlierAffected
AM304LMilesight
  • 1.2 and earlierAffected
AM305LMilesight
  • 1.2 and earlierAffected
AM307 V2Milesight
  • 1.4 and earlierAffected
AM308Milesight
  • 1.7 and earlierAffected
AM308LMilesight
  • 1.7 and earlierAffected
AM319Milesight
  • 1.6 and earlierAffected
WS101Milesight
  • 1.5 and earlierAffected
WS136Milesight
  • 1.6 and earlierAffected
WS156Milesight
  • 1.6 and earlierAffected
WS201Milesight
  • 1.2 and earlierAffected
WS202Milesight
  • 1.8 and earlierAffected
WS203Milesight
  • 1.3 and earlierAffected
WS301Milesight
  • 1.15 and earlierAffected
WS303Milesight
  • 1.5 and earlierAffected
WS50X (2W-W11-EU) [501/502/503]Milesight
  • 1.3 and earlierAffected
WS50X (3W-W11-EU) [501/502/503]Milesight
  • 1.2 and earlierAffected
WS50X (3W-W12-EU) [501/502/503]Milesight
  • 1.2 and earlierAffected
WS51X [513/515]Milesight
  • 1.9 and earlierAffected
WS52X [523/525]Milesight
  • 1.12 and earlierAffected
WS558Milesight
  • 1.1 and earlierAffected
VS321Milesight
  • 321.1.0.1-r5 and earlierAffected
VS360Milesight
  • 1.2-r1 and earlierAffected
VS350 V3Milesight
  • 1.1 and earlierAffected
VS351Milesight
  • 1.5 and earlierAffected
VS330Milesight
  • 1.3 and earlierAffected
VS340Milesight
  • 1.1 and earlierAffected
VS341Milesight
  • 1.1 and earlierAffected
VS370Milesight
  • 1.1 and earlierAffected
GS301Milesight
  • 1.2 and earlierAffected
EM300-TH V3Milesight
  • 1.10 and earlierAffected
EM320-THMilesight
  • 1.6 and earlierAffected
TS201 V2Milesight
  • 1.1 and earlierAffected
TS30x V2Milesight
  • 1.1 and earlierAffected
WT201 V2Milesight
  • 1.5 and earlierAffected
WT211 V2Milesight
  • 1.5 and earlierAffected
UC501Milesight
  • 1.6 and earlierAffected
UC502Milesight
  • 1.6 and earlierAffected
UC511 V4Milesight
  • 1.6 and earlierAffected
UC512 V4Milesight
  • 1.6 and earlierAffected
UC521 LoRaWAN®Milesight
  • 1.2 and earlierAffected
UC521 CellularMilesight
  • 1.3 and earlierAffected
EM300-DIMilesight
  • 1.3 and earlierAffected
EM300-MCS V3Milesight
  • 1.10 and earlierAffected
EM300-MLD V3Milesight
  • 1.10 and earlierAffected
EM300-SLD V3Milesight
  • 1.10 and earlierAffected
EM300-ZLD V3Milesight
  • 1.10 and earlierAffected
EM320-TILTMilesight
  • 1.3 and earlierAffected
EM400-TLD LoRaWAN®Milesight
  • 1.2 and earlierAffected
EM400-TLD NB-IoTMilesight
  • 1.5 and earlierAffected
EM400-MUD LoRaWAN®Milesight
  • 1.2 and earlierAffected
EM400-MUD NB-IoTMilesight
  • 1.6 and earlierAffected
EM400-UDL LoRaWAN®Milesight
  • 1.2 and earlierAffected
EM410-RDL CellularMilesight
  • 1.1 and earlierAffected
EM411-RDLMilesight
  • 1.2 and earlierAffected
EM500-CO2 V2Milesight
  • 1.11 and earlierAffected
EM500-SWLMilesight
  • 1.11 and earlierAffected
EM500-LGTMilesight
  • 1.11 and earlierAffected
EM500-PT100 V2Milesight
  • 1.11 and earlierAffected
EM500-PPMilesight
  • 1.11 and earlierAffected
EM500-SMTCMilesight
  • 1.11 and earlierAffected
EM500-UDLMilesight
  • 1.11 and earlierAffected
AT101Milesight
  • 1.2 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.