{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-29988","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","state":"PUBLISHED","assignerShortName":"mitre","dateReserved":"2026-03-04T16:57:42.093Z","datePublished":"2026-08-26T03:14:26.632Z","dateUpdated":"2026-08-26T15:29:07.675Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"AM102/102L V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM103/103L V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.8","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM304L","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM305L","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM307 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM308","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM308L","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AM319","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS101","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS136","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS156","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS201","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS202","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.8","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS203","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS301","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.15","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS303","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS50X (2W-W11-EU) [501/502/503]","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS50X (3W-W11-EU) [501/502/503]","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS50X (3W-W12-EU) [501/502/503]","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS51X [513/515]","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS52X [523/525]","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.12","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WS558","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS321","vendor":"Milesight","versions":[{"lessThanOrEqual":"321.1.0.1-r5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS360","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2-r1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS350 V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS351","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS330","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS340","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS341","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"VS370","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"GS301","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-TH V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM320-TH","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"TS201 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"TS30x V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WT201 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WT211 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC501","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC502","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC511 V4","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC512 V4","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC521 LoRaWAN®","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UC521 Cellular","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-DI","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-MCS V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-MLD V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-SLD V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM300-ZLD V3","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM320-TILT","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.3","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM400-TLD LoRaWAN®","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM400-TLD NB-IoT","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM400-MUD LoRaWAN®","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM400-MUD NB-IoT","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.6","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM400-UDL LoRaWAN®","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM410-RDL Cellular","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM411-RDL","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-CO2 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-SWL","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-LGT","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-PT100 V2","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-PP","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-SMTC","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"EM500-UDL","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.11","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"AT101","vendor":"Milesight","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected."}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","baseScore":8.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","description":"CWE-319: Cleartext Transmission of Sensitive Information","lang":"en","type":"CWE"}]}],"references":[{"tags":["vendor-advisory","mitigation"],"url":"https://www.milesight.com/legal/vulnerabilities-in-some-milesight-sensors"}],"providerMetadata":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-08-26T03:14:26.632Z"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-26T15:25:42.641353Z","id":"CVE-2026-29988","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-26T15:29:07.675Z"}}]}}