A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecte
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Milesight AM102/102L V2
through 1.4
- Milesight AM103/103L V2
through 1.8
- Milesight AM304L
through 1.2
- Milesight AM305L
through 1.2
- Milesight AM307 V2
through 1.4
- Milesight AM308
through 1.7
- Milesight AM308L
through 1.7
- Milesight AM319
through 1.6
- Milesight WS101
through 1.5
- Milesight WS136
through 1.6
- Milesight WS156
through 1.6
- Milesight WS201
through 1.2
- Milesight WS202
through 1.8
- Milesight WS203
through 1.3
- Milesight WS301
through 1.15
- Milesight WS303
through 1.5
- Milesight WS50X (2W-W11-EU) [501/502/503]
through 1.3
- Milesight WS50X (3W-W11-EU) [501/502/503]
through 1.2
- Milesight WS50X (3W-W12-EU) [501/502/503]
through 1.2
- Milesight WS51X [513/515]
through 1.9
- Milesight WS52X [523/525]
through 1.12
- Milesight WS558
through 1.1
- Milesight VS321
through 321.1.0.1-r5
- Milesight VS360
through 1.2-r1
- Milesight VS350 V3
through 1.1
- Milesight VS351
through 1.5
- Milesight VS330
through 1.3
- Milesight VS340
through 1.1
- Milesight VS341
through 1.1
- Milesight VS370
through 1.1
- Milesight GS301
through 1.2
- Milesight EM300-TH V3
through 1.10
- Milesight EM320-TH
through 1.6
- Milesight TS201 V2
through 1.1
- Milesight TS30x V2
through 1.1
- Milesight WT201 V2
through 1.5
- Milesight WT211 V2
through 1.5
- Milesight UC501
through 1.6
- Milesight UC502
through 1.6
- Milesight UC511 V4
through 1.6
- Milesight UC512 V4
through 1.6
- Milesight UC521 LoRaWAN®
through 1.2
- Milesight UC521 Cellular
through 1.3
- Milesight EM300-DI
through 1.3
- Milesight EM300-MCS V3
through 1.10
- Milesight EM300-MLD V3
through 1.10
- Milesight EM300-SLD V3
through 1.10
- Milesight EM300-ZLD V3
through 1.10
- Milesight EM320-TILT
through 1.3
- Milesight EM400-TLD LoRaWAN®
through 1.2
- Milesight EM400-TLD NB-IoT
through 1.5
- Milesight EM400-MUD LoRaWAN®
through 1.2
- Milesight EM400-MUD NB-IoT
through 1.6
- Milesight EM400-UDL LoRaWAN®
through 1.2
- Milesight EM410-RDL Cellular
through 1.1
- Milesight EM411-RDL
through 1.2
- Milesight EM500-CO2 V2
through 1.11
- Milesight EM500-SWL
through 1.11
- Milesight EM500-LGT
through 1.11
- Milesight EM500-PT100 V2
through 1.11
- Milesight EM500-PP
through 1.11
- Milesight EM500-SMTC
through 1.11
- Milesight EM500-UDL
through 1.11
- Milesight AT101
through 1.2