Read the docs
TI-2026-23416 Aliases CVE-2026-29988GHSA-x7rj-767c-4728

Cleartext transmission of sensitive information in Milesight AM102/102L V2

Priority LOW 37CWE-319Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MilesightAM102/102L V2up to 1.4—No fix listedCNA
MilesightAM103/103L V2up to 1.8—No fix listedCNA
MilesightAM304Lup to 1.2—No fix listedCNA
MilesightAM305Lup to 1.2—No fix listedCNA
MilesightAM307 V2up to 1.4—No fix listedCNA
MilesightAM308up to 1.7—No fix listedCNA
MilesightAM308Lup to 1.7—No fix listedCNA
MilesightAM319up to 1.6—No fix listedCNA
MilesightWS101up to 1.5—No fix listedCNA
MilesightWS136up to 1.6—No fix listedCNA
MilesightWS156up to 1.6—No fix listedCNA
MilesightWS201up to 1.2—No fix listedCNA
MilesightWS202up to 1.8—No fix listedCNA
MilesightWS203up to 1.3—No fix listedCNA
MilesightWS301up to 1.15—No fix listedCNA
MilesightWS303up to 1.5—No fix listedCNA
MilesightWS50X (2W-W11-EU) [501/502/503]up to 1.3—No fix listedCNA
MilesightWS50X (3W-W11-EU) [501/502/503]up to 1.2—No fix listedCNA
MilesightWS50X (3W-W12-EU) [501/502/503]up to 1.2—No fix listedCNA
MilesightWS51X [513/515]up to 1.9—No fix listedCNA
MilesightWS52X [523/525]up to 1.12—No fix listedCNA
MilesightWS558up to 1.1—No fix listedCNA
MilesightVS321up to 321.1.0.1-r5—No fix listedCNA
MilesightVS360up to 1.2-r1—No fix listedCNA
MilesightVS350 V3up to 1.1—No fix listedCNA
MilesightVS351up to 1.5—No fix listedCNA
MilesightVS330up to 1.3—No fix listedCNA
MilesightVS340up to 1.1—No fix listedCNA
MilesightVS341up to 1.1—No fix listedCNA
MilesightVS370up to 1.1—No fix listedCNA
MilesightGS301up to 1.2—No fix listedCNA
MilesightEM300-TH V3up to 1.10—No fix listedCNA
MilesightEM320-THup to 1.6—No fix listedCNA
MilesightTS201 V2up to 1.1—No fix listedCNA
MilesightTS30x V2up to 1.1—No fix listedCNA
MilesightWT201 V2up to 1.5—No fix listedCNA
MilesightWT211 V2up to 1.5—No fix listedCNA
MilesightUC501up to 1.6—No fix listedCNA
MilesightUC502up to 1.6—No fix listedCNA
MilesightUC511 V4up to 1.6—No fix listedCNA
MilesightUC512 V4up to 1.6—No fix listedCNA
MilesightUC521 LoRaWAN®up to 1.2—No fix listedCNA
MilesightUC521 Cellularup to 1.3—No fix listedCNA
MilesightEM300-DIup to 1.3—No fix listedCNA
MilesightEM300-MCS V3up to 1.10—No fix listedCNA
MilesightEM300-MLD V3up to 1.10—No fix listedCNA
MilesightEM300-SLD V3up to 1.10—No fix listedCNA
MilesightEM300-ZLD V3up to 1.10—No fix listedCNA
MilesightEM320-TILTup to 1.3—No fix listedCNA
MilesightEM400-TLD LoRaWAN®up to 1.2—No fix listedCNA
MilesightEM400-TLD NB-IoTup to 1.5—No fix listedCNA
MilesightEM400-MUD LoRaWAN®up to 1.2—No fix listedCNA
MilesightEM400-MUD NB-IoTup to 1.6—No fix listedCNA
MilesightEM400-UDL LoRaWAN®up to 1.2—No fix listedCNA
MilesightEM410-RDL Cellularup to 1.1—No fix listedCNA
MilesightEM411-RDLup to 1.2—No fix listedCNA
MilesightEM500-CO2 V2up to 1.11—No fix listedCNA
MilesightEM500-SWLup to 1.11—No fix listedCNA
MilesightEM500-LGTup to 1.11—No fix listedCNA
MilesightEM500-PT100 V2up to 1.11—No fix listedCNA
MilesightEM500-PPup to 1.11—No fix listedCNA
MilesightEM500-SMTCup to 1.11—No fix listedCNA
MilesightEM500-UDLup to 1.11—No fix listedCNA
MilesightAT101up to 1.2—No fix listedCNA
  • AM102/102L V2 VendorMilesight Affected up to 1.4 Fixed in — No fix listed CNA
  • AM103/103L V2 VendorMilesight Affected up to 1.8 Fixed in — No fix listed CNA
  • AM304L VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • AM305L VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • AM307 V2 VendorMilesight Affected up to 1.4 Fixed in — No fix listed CNA
  • AM308 VendorMilesight Affected up to 1.7 Fixed in — No fix listed CNA
  • AM308L VendorMilesight Affected up to 1.7 Fixed in — No fix listed CNA
  • AM319 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • WS101 VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • WS136 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • WS156 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • WS201 VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • WS202 VendorMilesight Affected up to 1.8 Fixed in — No fix listed CNA
  • WS203 VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • WS301 VendorMilesight Affected up to 1.15 Fixed in — No fix listed CNA
  • WS303 VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • WS50X (2W-W11-EU) [501/502/503] VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • WS50X (3W-W11-EU) [501/502/503] VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • WS50X (3W-W12-EU) [501/502/503] VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • WS51X [513/515] VendorMilesight Affected up to 1.9 Fixed in — No fix listed CNA
  • WS52X [523/525] VendorMilesight Affected up to 1.12 Fixed in — No fix listed CNA
  • WS558 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • VS321 VendorMilesight Affected up to 321.1.0.1-r5 Fixed in — No fix listed CNA
  • VS360 VendorMilesight Affected up to 1.2-r1 Fixed in — No fix listed CNA
  • VS350 V3 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • VS351 VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • VS330 VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • VS340 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • VS341 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • VS370 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • GS301 VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • EM300-TH V3 VendorMilesight Affected up to 1.10 Fixed in — No fix listed CNA
  • EM320-TH VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • TS201 V2 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • TS30x V2 VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • WT201 V2 VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • WT211 V2 VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • UC501 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • UC502 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • UC511 V4 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • UC512 V4 VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • UC521 LoRaWAN® VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • UC521 Cellular VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • EM300-DI VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • EM300-MCS V3 VendorMilesight Affected up to 1.10 Fixed in — No fix listed CNA
  • EM300-MLD V3 VendorMilesight Affected up to 1.10 Fixed in — No fix listed CNA
  • EM300-SLD V3 VendorMilesight Affected up to 1.10 Fixed in — No fix listed CNA
  • EM300-ZLD V3 VendorMilesight Affected up to 1.10 Fixed in — No fix listed CNA
  • EM320-TILT VendorMilesight Affected up to 1.3 Fixed in — No fix listed CNA
  • EM400-TLD LoRaWAN® VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • EM400-TLD NB-IoT VendorMilesight Affected up to 1.5 Fixed in — No fix listed CNA
  • EM400-MUD LoRaWAN® VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • EM400-MUD NB-IoT VendorMilesight Affected up to 1.6 Fixed in — No fix listed CNA
  • EM400-UDL LoRaWAN® VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • EM410-RDL Cellular VendorMilesight Affected up to 1.1 Fixed in — No fix listed CNA
  • EM411-RDL VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA
  • EM500-CO2 V2 VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-SWL VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-LGT VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-PT100 V2 VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-PP VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-SMTC VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • EM500-UDL VendorMilesight Affected up to 1.11 Fixed in — No fix listed CNA
  • AT101 VendorMilesight Affected up to 1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29988
  2. 2026-10-03 Alias added: GHSA-x7rj-767c-4728

References

Advisory 1

  • TI-2023-09701 Stack-based buffer overflow in Milesight UR32L CVSS 3.1CRITICAL 9.8
  • TI-2023-08998 An authentication bypass vulnerability exists in the requestHandlers.js verifyToken… CVSS 3.1CRITICAL 9.8
  • TI-2023-08584 SQL injection in MilesightVPN CVSS 3.1CRITICAL 9.8
  • TI-2023-23160 An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7… CVSS 3.1HIGH 7.5
  • TI-2023-10201 Command injection in Milesight UR32L CVSS 3.1HIGH 8.8
  • TI-2023-10200 Command injection in Milesight UR32L CVSS 3.1HIGH 8.8
See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences