CVE-2026-29988: CWE-319: Cleartext Transmission of Sensitive Information in Milesight AM102/102L V2

This vulnerability involves the cleartext transmission of sensitive LoRaWAN keys via the NFC interface on affected Milesight AM102/102L V2 devices. An attacker physically near the device can perform an NFC read operation without authentication to extract network session keys (NwkSKey), application session keys (AppSKey), and device-to-device (D2D) keys. Possession of these keys enables decryption of LoRaWAN traffic, frame forgery, injection of falsified sensor data, execution of supported device commands, and rejection of legitimate frames, severely compromising device and network integrity.

The exposure of LoRaWAN session keys and D2D keys compromises confidentiality and integrity of communications. Attackers can decrypt sensitive data, impersonate devices by forging uplink and downlink frames, inject false sensor readings, and disrupt normal device operations by causing legitimate frames to be rejected. This undermines trust in the IoT network and may lead to operational disruptions or data manipulation.

No official patch or remediation is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is provided, physical security controls to prevent unauthorized NFC access are recommended. Avoid placing devices in easily accessible locations and consider disabling NFC if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.