Answer in brief
CVE-2026-29988 records a High severity (CVSS 7.6) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps Milesight/AM102/102L V2 (generic), Milesight/AM102/102L V2 (generic), Milesight/AM103/103L V2 (generic), Milesight/AM103/103L V2 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Milesight/AM102/102L V2 (generic), Milesight/AM102/102L V2 (generic), Milesight/AM103/103L V2 (generic), Milesight/AM103/103L V2 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Milesight/AM102/102L V2generic | 0 | Not reported |
| Milesight/AM102/102L V2generic | >=0 <=1.4 | Not reported |
| Milesight/AM103/103L V2generic | 0 | Not reported |
| Milesight/AM103/103L V2generic | >=0 <=1.8 | Not reported |
| Milesight/AM304Lgeneric | 0 | Not reported |
| Milesight/AM304Lgeneric | >=0 <=1.2 | Not reported |
| Milesight/AM305Lgeneric | 0 | Not reported |
| Milesight/AM305Lgeneric | >=0 <=1.2 | Not reported |
| Milesight/AM307 V2generic | 0 | Not reported |
| Milesight/AM307 V2generic | >=0 <=1.4 | Not reported |
| Milesight/AM308generic | 0 | Not reported |
| Milesight/AM308generic | >=0 <=1.7 | Not reported |
| Milesight/AM308Lgeneric | 0 | Not reported |
| Milesight/AM308Lgeneric | >=0 <=1.7 | Not reported |
| Milesight/AM319generic | 0 | Not reported |
| Milesight/AM319generic | >=0 <=1.6 | Not reported |
| Milesight/AT101generic | 0 | Not reported |
| Milesight/AT101generic | >=0 <=1.2 | Not reported |
| Milesight/EM300-DIgeneric | 0 | Not reported |
| Milesight/EM300-DIgeneric | >=0 <=1.3 | Not reported |
| Milesight/EM300-MCS V3generic | 0 | Not reported |
| Milesight/EM300-MCS V3generic | >=0 <=1.10 | Not reported |
| Milesight/EM300-MLD V3generic | 0 | Not reported |
| Milesight/EM300-MLD V3generic | >=0 <=1.10 | Not reported |
| Milesight/EM300-SLD V3generic | 0 | Not reported |
| Milesight/EM300-SLD V3generic | >=0 <=1.10 | Not reported |
| Milesight/EM300-TH V3generic | 0 | Not reported |
| Milesight/EM300-TH V3generic | >=0 <=1.10 | Not reported |
| Milesight/EM300-ZLD V3generic | 0 | Not reported |
| Milesight/EM300-ZLD V3generic | >=0 <=1.10 | Not reported |
| Milesight/EM320-THgeneric | 0 | Not reported |
| Milesight/EM320-THgeneric | >=0 <=1.6 | Not reported |
| Milesight/EM320-TILTgeneric | 0 | Not reported |
| Milesight/EM320-TILTgeneric | >=0 <=1.3 | Not reported |
| Milesight/EM400-MUD LoRaWAN®generic | 0 | Not reported |
| Milesight/EM400-MUD LoRaWAN®generic | >=0 <=1.2 | Not reported |
| Milesight/EM400-MUD NB-IoTgeneric | 0 | Not reported |
| Milesight/EM400-MUD NB-IoTgeneric | >=0 <=1.6 | Not reported |
| Milesight/EM400-TLD LoRaWAN®generic | 0 | Not reported |
| Milesight/EM400-TLD LoRaWAN®generic | >=0 <=1.2 | Not reported |
| Milesight/EM400-TLD NB-IoTgeneric | 0 | Not reported |
| Milesight/EM400-TLD NB-IoTgeneric | >=0 <=1.5 | Not reported |
| Milesight/EM400-UDL LoRaWAN®generic | 0 | Not reported |
| Milesight/EM400-UDL LoRaWAN®generic | >=0 <=1.2 | Not reported |
| Milesight/EM410-RDL Cellulargeneric | 0 | Not reported |
| Milesight/EM410-RDL Cellulargeneric | >=0 <=1.1 | Not reported |
| Milesight/EM411-RDLgeneric | 0 | Not reported |
| Milesight/EM411-RDLgeneric | >=0 <=1.2 | Not reported |
| Milesight/EM500-CO2 V2generic | 0 | Not reported |
| Milesight/EM500-CO2 V2generic | >=0 <=1.11 | Not reported |
| Milesight/EM500-LGTgeneric | 0 | Not reported |
| Milesight/EM500-LGTgeneric | >=0 <=1.11 | Not reported |
| Milesight/EM500-PPgeneric | 0 | Not reported |
| Milesight/EM500-PPgeneric | >=0 <=1.11 | Not reported |
| Milesight/EM500-PT100 V2generic | 0 | Not reported |
| Milesight/EM500-PT100 V2generic | >=0 <=1.11 | Not reported |
| Milesight/EM500-SMTCgeneric | 0 | Not reported |
| Milesight/EM500-SMTCgeneric | >=0 <=1.11 | Not reported |
| Milesight/EM500-SWLgeneric | 0 | Not reported |
| Milesight/EM500-SWLgeneric | >=0 <=1.11 | Not reported |
| Milesight/EM500-UDLgeneric | 0 | Not reported |
| Milesight/EM500-UDLgeneric | >=0 <=1.11 | Not reported |
| Milesight/GS301generic | 0 | Not reported |
| Milesight/GS301generic | >=0 <=1.2 | Not reported |
| Milesight/TS201 V2generic | 0 | Not reported |
| Milesight/TS201 V2generic | >=0 <=1.1 | Not reported |
| Milesight/TS30x V2generic | 0 | Not reported |
| Milesight/TS30x V2generic | >=0 <=1.1 | Not reported |
| Milesight/UC501generic | 0 | Not reported |
| Milesight/UC501generic | >=0 <=1.6 | Not reported |
| Milesight/UC502generic | 0 | Not reported |
| Milesight/UC502generic | >=0 <=1.6 | Not reported |
| Milesight/UC511 V4generic | 0 | Not reported |
| Milesight/UC511 V4generic | >=0 <=1.6 | Not reported |
| Milesight/UC512 V4generic | 0 | Not reported |
| Milesight/UC512 V4generic | >=0 <=1.6 | Not reported |
| Milesight/UC521 Cellulargeneric | 0 | Not reported |
| Milesight/UC521 Cellulargeneric | >=0 <=1.3 | Not reported |
| Milesight/UC521 LoRaWAN®generic | 0 | Not reported |
| Milesight/UC521 LoRaWAN®generic | >=0 <=1.2 | Not reported |
| Milesight/VS321generic | 0 | Not reported |
| Milesight/VS321generic | >=0 <=321.1.0.1-r5 | Not reported |
| Milesight/VS330generic | 0 | Not reported |
| Milesight/VS330generic | >=0 <=1.3 | Not reported |
| Milesight/VS340generic | 0 | Not reported |
| Milesight/VS340generic | >=0 <=1.1 | Not reported |
| Milesight/VS341generic | 0 | Not reported |
| Milesight/VS341generic | >=0 <=1.1 | Not reported |
| Milesight/VS350 V3generic | 0 | Not reported |
| Milesight/VS350 V3generic | >=0 <=1.1 | Not reported |
| Milesight/VS351generic | 0 | Not reported |
| Milesight/VS351generic | >=0 <=1.5 | Not reported |
| Milesight/VS360generic | 0 | Not reported |
| Milesight/VS360generic | >=0 <=1.2-r1 | Not reported |
| Milesight/VS370generic | 0 | Not reported |
| Milesight/VS370generic | >=0 <=1.1 | Not reported |
| Milesight/WS101generic | 0 | Not reported |
| Milesight/WS101generic | >=0 <=1.5 | Not reported |
| Milesight/WS136generic | 0 | Not reported |
| Milesight/WS136generic | >=0 <=1.6 | Not reported |
| Milesight/WS156generic | 0 | Not reported |
| Milesight/WS156generic | >=0 <=1.6 | Not reported |
| Milesight/WS201generic | 0 | Not reported |
| Milesight/WS201generic | >=0 <=1.2 | Not reported |
| Milesight/WS202generic | 0 | Not reported |
| Milesight/WS202generic | >=0 <=1.8 | Not reported |
| Milesight/WS203generic | 0 | Not reported |
| Milesight/WS203generic | >=0 <=1.3 | Not reported |
| Milesight/WS301generic | 0 | Not reported |
| Milesight/WS301generic | >=0 <=1.15 | Not reported |
| Milesight/WS303generic | 0 | Not reported |
| Milesight/WS303generic | >=0 <=1.5 | Not reported |
| Milesight/WS50X (2W-W11-EU) [501/502/503]generic | 0 | Not reported |
| Milesight/WS50X (2W-W11-EU) [501/502/503]generic | >=0 <=1.3 | Not reported |
| Milesight/WS50X (3W-W11-EU) [501/502/503]generic | 0 | Not reported |
| Milesight/WS50X (3W-W11-EU) [501/502/503]generic | >=0 <=1.2 | Not reported |
| Milesight/WS50X (3W-W12-EU) [501/502/503]generic | 0 | Not reported |
| Milesight/WS50X (3W-W12-EU) [501/502/503]generic | >=0 <=1.2 | Not reported |
| Milesight/WS51X [513/515]generic | 0 | Not reported |
| Milesight/WS51X [513/515]generic | >=0 <=1.9 | Not reported |
| Milesight/WS52X [523/525]generic | 0 | Not reported |
| Milesight/WS52X [523/525]generic | >=0 <=1.12 | Not reported |
| Milesight/WS558generic | 0 | Not reported |
| Milesight/WS558generic | >=0 <=1.1 | Not reported |
| Milesight/WT201 V2generic | 0 | Not reported |
| Milesight/WT201 V2generic | >=0 <=1.5 | Not reported |
| Milesight/WT211 V2generic | 0 | Not reported |
| Milesight/WT211 V2generic | >=0 <=1.5 | Not reported |
Published upstream
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 26, 2026
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames, submit falsified sensor data, issue supported device commands, and cause subsequent legitimate frames to be rejected.
Quoted source text, attributed separately from HOL analysis.