The vulnerability (CVE-2026-75907) affects Norwegian Cruise Line door access controllers that authenticate NFC credentials solely based on their static 7-byte UID. Since the UID is publicly readable and does not support cryptographic operations, it cannot reliably authenticate users. The card readers ignore other data on the NTAG212 tags, such as serial numbers or signature-like values, relying only on the UID for access control. This design flaw allows attackers with brief physical proximity to capture a valid UID and clone it onto inexpensive writable cards, which the access control system will accept as genuine, enabling unauthorized entry. The vulnerability has not been coordinated with the vendor, and no official fix is available.

An attacker can clone valid access cards by capturing their UIDs without interacting with or altering the original cards. These cloned cards can grant unauthorized access to restricted areas on cruise ships, potentially compromising internal operations and guest safety. Unauthorized entries may be indistinguishable from legitimate use depending on logging configurations. This presents a significant security risk due to the physical safety implications aboard cruise vessels.

No official patch or fix is available as the vendor was not reached for coordination. Users should employ physical mitigations such as RFID-blocking wallets or shielded card-holder sleeves to prevent unauthorized scans. Applying aluminum foil on both sides of the RFID card can create a basic Faraday shield to limit signal transmission. Additionally, maintaining a distance of at least 12 inches from other people or devices when using or storing the card can reduce the risk of unauthorized reading.