Description
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Milesight AM102/102L V2
Default version status: unaffected
0 to ≤ 1.4affected
Milesight AM103/103L V2
Default version status: unaffected
0 to ≤ 1.8affected
Milesight AM304L
Default version status: unaffected
0 to ≤ 1.2affected
Milesight AM305L
Default version status: unaffected
0 to ≤ 1.2affected
Milesight AM307 V2
Default version status: unaffected
0 to ≤ 1.4affected
Milesight AM308
Default version status: unaffected
0 to ≤ 1.7affected
Milesight AM308L
Default version status: unaffected
0 to ≤ 1.7affected
Milesight AM319
Default version status: unaffected
0 to ≤ 1.6affected
Milesight WS101
Default version status: unaffected
0 to ≤ 1.5affected
Milesight WS136
Default version status: unaffected
0 to ≤ 1.6affected
Milesight WS156
Default version status: unaffected
0 to ≤ 1.6affected
Milesight WS201
Default version status: unaffected
0 to ≤ 1.2affected
Milesight WS202
Default version status: unaffected
0 to ≤ 1.8affected
Milesight WS203
Default version status: unaffected
0 to ≤ 1.3affected
Milesight WS301
Default version status: unaffected
0 to ≤ 1.15affected
Milesight WS303
Default version status: unaffected
0 to ≤ 1.5affected
Milesight WS50X (2W-W11-EU) [501/502/503]
Default version status: unaffected
0 to ≤ 1.3affected
Milesight WS50X (3W-W11-EU) [501/502/503]
Default version status: unaffected
0 to ≤ 1.2affected
Milesight WS50X (3W-W12-EU) [501/502/503]
Default version status: unaffected
0 to ≤ 1.2affected
Milesight WS51X [513/515]
Default version status: unaffected
0 to ≤ 1.9affected
Milesight WS52X [523/525]
Default version status: unaffected
0 to ≤ 1.12affected
Milesight WS558
Default version status: unaffected
0 to ≤ 1.1affected
Milesight VS321
Default version status: unaffected
0 to ≤ 321.1.0.1-r5affected
Milesight VS360
Default version status: unaffected
0 to ≤ 1.2-r1affected
Milesight VS350 V3
Default version status: unaffected
0 to ≤ 1.1affected
Milesight VS351
Default version status: unaffected
0 to ≤ 1.5affected
Milesight VS330
Default version status: unaffected
0 to ≤ 1.3affected
Milesight VS340
Default version status: unaffected
0 to ≤ 1.1affected
Milesight VS341
Default version status: unaffected
0 to ≤ 1.1affected
Milesight VS370
Default version status: unaffected
0 to ≤ 1.1affected
Milesight GS301
Default version status: unaffected
0 to ≤ 1.2affected
Milesight EM300-TH V3
Default version status: unaffected
0 to ≤ 1.10affected
Milesight EM320-TH
Default version status: unaffected
0 to ≤ 1.6affected
Milesight TS201 V2
Default version status: unaffected
0 to ≤ 1.1affected
Milesight TS30x V2
Default version status: unaffected
0 to ≤ 1.1affected
Milesight WT201 V2
Default version status: unaffected
0 to ≤ 1.5affected
Milesight WT211 V2
Default version status: unaffected
0 to ≤ 1.5affected
Milesight UC501
Default version status: unaffected
0 to ≤ 1.6affected
Milesight UC502
Default version status: unaffected
0 to ≤ 1.6affected
Milesight UC511 V4
Default version status: unaffected
0 to ≤ 1.6affected
Milesight UC512 V4
Default version status: unaffected
0 to ≤ 1.6affected
Milesight UC521 LoRaWAN®
Default version status: unaffected
0 to ≤ 1.2affected
Milesight UC521 Cellular
Default version status: unaffected
0 to ≤ 1.3affected
Milesight EM300-DI
Default version status: unaffected
0 to ≤ 1.3affected
Milesight EM300-MCS V3
Default version status: unaffected
0 to ≤ 1.10affected
Milesight EM300-MLD V3
Default version status: unaffected
0 to ≤ 1.10affected
Milesight EM300-SLD V3
Default version status: unaffected
0 to ≤ 1.10affected
Milesight EM300-ZLD V3
Default version status: unaffected
0 to ≤ 1.10affected
Milesight EM320-TILT
Default version status: unaffected
0 to ≤ 1.3affected
Milesight EM400-TLD LoRaWAN®
Default version status: unaffected
0 to ≤ 1.2affected
Milesight EM400-TLD NB-IoT
Default version status: unaffected
0 to ≤ 1.5affected
Milesight EM400-MUD LoRaWAN®
Default version status: unaffected
0 to ≤ 1.2affected
Milesight EM400-MUD NB-IoT
Default version status: unaffected
0 to ≤ 1.6affected
Milesight EM400-UDL LoRaWAN®
Default version status: unaffected
0 to ≤ 1.2affected
Milesight EM410-RDL Cellular
Default version status: unaffected
0 to ≤ 1.1affected
Milesight EM411-RDL
Default version status: unaffected
0 to ≤ 1.2affected
Milesight EM500-CO2 V2
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-SWL
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-LGT
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-PT100 V2
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-PP
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-SMTC
Default version status: unaffected
0 to ≤ 1.11affected
Milesight EM500-UDL
Default version status: unaffected
0 to ≤ 1.11affected
Milesight AT101
Default version status: unaffected
0 to ≤ 1.2affected