CVE-2026-29988: Milesight IoT NFC Information Disclosure

CVE-2026-29988 Overview

CVE-2026-29988 is a cleartext transmission of sensitive information vulnerability [CWE-319] affecting the Near Field Communication (NFC) interface of multiple Milesight IoT device models. An unauthenticated attacker with physical proximity can perform an NFC read operation to retrieve LoRaWAN Activation By Personalization (ABP) NwkSKey and AppSKey values, along with Device-to-Device (D2D) keys. Once extracted, these keys allow decryption of LoRaWAN traffic, forgery of uplink and downlink frames, submission of falsified sensor data, and issuance of supported device commands. Legitimate frames sent after key abuse can also be rejected by the network.

Critical Impact
Physical NFC access exposes LoRaWAN session keys in cleartext, enabling traffic decryption, frame forgery, and disruption of legitimate sensor communications.

Affected Products

Multiple Milesight IoT sensor device models (specific models enumerated in vendor advisory)
Devices exposing an NFC configuration interface for LoRaWAN ABP provisioning
Devices provisioned with D2D keys accessible over NFC

Discovery Timeline

2026-08-26 - CVE-2026-29988 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-29988

Vulnerability Analysis

The vulnerability resides in the NFC provisioning interface used to configure affected Milesight IoT sensors. The interface returns LoRaWAN ABP session keys and D2D keys without applying encryption or requiring authentication. An attacker holding an NFC-capable device within physical range can issue a read operation and receive NwkSKey, AppSKey, and D2D key material in plaintext.

Exposure of the NwkSKey breaks Message Integrity Code (MIC) protection for LoRaWAN frames, while exposure of the AppSKey breaks payload confidentiality. Together, they collapse the LoRaWAN security model for the affected device. D2D key disclosure additionally allows an attacker to impersonate peer devices in Milesight's device-to-device signaling scheme.

Root Cause

The root cause is the transmission of secret key material over the NFC channel without cryptographic protection or access control, categorized as CWE-319 (Cleartext Transmission of Sensitive Information). The design assumes physical proximity is sufficient to authorize disclosure of long-lived cryptographic secrets.

Attack Vector

Exploitation requires physical proximity to the target device, typically a few centimeters, consistent with the NFC protocol range. No authentication, user interaction, or elevated privileges are required. The attack sequence is:

Approach the target Milesight sensor with an NFC-capable reader (for example, a smartphone with the vendor's configuration app or a custom NFC client).
Issue an NFC read command targeting the configuration data structures.
Parse the returned data to extract NwkSKey, AppSKey, and D2D key values.
Use the recovered keys to decrypt captured LoRaWAN traffic, craft forged uplink or downlink frames, or inject D2D commands.

Because LoRaWAN ABP uses static session keys, key rotation requires manual reprovisioning, so a single compromise persists until the device is reconfigured.

No verified public exploit code is available. See the Milesight Vulnerabilities Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-29988

Indicators of Compromise

Unexpected uplink frames from a known device identifier arriving with anomalous payload structure, timing, or sensor values inconsistent with historical baselines.
Legitimate frames being rejected by the network server due to frame counter (FCntUp) desynchronization caused by attacker-injected traffic.
Downlink commands issued to sensors outside of scheduled maintenance windows or from unexpected application server contexts.
Physical evidence of tampering or unauthorized NFC access near deployed sensors.

Detection Strategies

Monitor LoRaWAN network server logs for MIC validation failures, frame counter resets, and gaps or jumps in FCntUp and FCntDown sequences.
Baseline sensor telemetry and alert on statistical deviations that could indicate falsified readings from forged frames.
Correlate downlink command issuance with authorized operator workflows to identify unauthorized D2D or application-layer commands.

Monitoring Recommendations

Enable verbose logging on the LoRaWAN network server and application server for authentication, decryption, and replay-detection events.
Ingest LoRaWAN gateway and network server logs into a centralized analytics platform for long-term retention and cross-device correlation.
Track physical access to sensor deployment locations and pair those records with network-side anomaly alerts.

How to Mitigate CVE-2026-29988

Immediate Actions Required

Inventory all deployed Milesight IoT sensors and cross-reference firmware versions against the vendor advisory to identify affected units.
Restrict physical access to deployed sensors, prioritizing devices in publicly accessible or low-supervision areas.
Where feasible, migrate provisioning from LoRaWAN ABP to Over-the-Air Activation (OTAA) so that session keys are derived dynamically and rotated on rejoin.
Rotate NwkSKey, AppSKey, and D2D keys on any device suspected of unauthorized NFC access.

Patch Information

Refer to the Milesight Vulnerabilities Advisory for the list of affected models, fixed firmware versions, and vendor-supplied upgrade instructions. Apply the vendor-provided firmware update to affected devices as soon as operationally feasible.

Workarounds

Disable the NFC interface on affected devices where the vendor firmware provides that option.
Physically shield or enclose sensors in tamper-resistant housings that block NFC read range.
Implement network-side anomaly detection on the LoRaWAN network server to identify forged frames and command injection attempts.
Reduce reliance on ABP by moving new deployments to OTAA and rotating any long-lived keys currently in use.