What is CVE-2026-29988?

CVE-2026-29988 is a high-severity vulnerability in Milesight Am102/102l V2, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.6/10. Published 2026-08-26.

How severe is CVE-2026-29988?

High severity. CVSS v3 base score is 7.6 out of 10.

Vulnerability in Milesight Am102/102l V2

CVE-2026-29988

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.

EPSS: 0.002 (4.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

cve@mitre.org (vendor-advisory, mitigation)

Frequently asked questions

What is CVE-2026-29988?: CVE-2026-29988 is a high-severity vulnerability in Milesight Am102/102l V2, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.6/10. Published 2026-08-26.
How severe is CVE-2026-29988?: High severity. CVSS v3 base score is 7.6 out of 10.