Vulnerabilities in Some Milesight Sensors

Date：2026-07-15

At Milesight, we take product security seriously. As part of our ongoing commitment to safeguarding users and systems, we continuously monitor for potential vulnerabilities and act swiftly to mitigate risks.

Recent internal security reviews, supplemented by external reports, have identified a vulnerability in specific firmware versions of Milesight IoT products.

Risk Overview

A security vulnerability has been identified that when an attacker uses NFC-enabled tools to read Milesight devices physically, the ABP keys and D2D keys are transmitted in plaintext. An unauthorized attacker can obtain the ABP nwkskey, appskey and D2D keys via NFC reading, and further launch subsequent attacks.

Exploitation Prerequisite

The attacker needs physical access to the device and uses specific NFC tools to retrieve key information.

Affected Scenarios

Devices deployed in public areas or locations without physical access control. Additionally, devices using ABP mode or D2D function.

Unaffected Scenarios

1. Devices working in OTAA mode (NFC transmission is encrypted and cannot be intercepted)

2. Devices with strict physical access restrictions, physical access to the device is not possible without authorization.

3. Devices that do not adopt ABP activation mode or enable D2D function.

Vulnerability Impact

1. Sensitive key information leakage via NFC plaintext transmission.

2. Attackers can remotely monitor and decrypt device data with stolen keys.

3. Attackers can tamper with device transmitted data.

4. Attackers may send unauthorized commands to D2D terminals and perform illegal operations.

Next Steps for Users

If your device is within the scope of the vulnerability, since the fixed versions have not yet been fully released,if possible, we recommend implementing physical access restrictions at the locations where your devices are deployed to prevent the devices from being easily accessed and to mitigate the vulnerability exploitation risk.

If your devices are deployed in public areas where physical access restrictions cannot be implemented, and are using ABP or D2D functionality, we recommend that you take the following temporary measures to reduce the risk of this vulnerability being exploited:

1. Switch Device from ABP Mode to OTAA Mode (Recommended)

(1) You can change the join type via local Toolbox or remote downlink command:

Local setting: Access Toolbox > Device > Network > LoRaWAN®, set Join Type to OTAA.

Remote downlink command to switch OTAA: 7e050900500101017e

(2) Please delete the old ABP configuration on Network Server, re-add the device with OTAA profile, and restart the device via Toolbox to re-join the network.

2. Temporarily Disable D2D Function

You can disable D2D function via local Toolbox or remote downlink command:

(1) Local setting: Disable D2D function via Toolbox device configuration page.

(2) Remote downlink command to disable D2D: 7e05090050f501007e

Note: Reference command to enable D2D: 7e05090050f501017e

Default D2D Key: 5572404C696E6B4C6F52613230313823

Firmware Remediation Plan

Milesight is developing patched firmware for affected product series in batches:

1. Most models will be fixed before July 30, 2026 or before October 30, 2026.

2. Partial models will be fixed before December 30, 2026.

We recommend you upgrade timely once the fixed firmware is available.

Affected Products & Estimated Fix Time

Milesight takes product security very seriously. We apologize for any inconvenience caused by this vulnerability. If you need any technical support or have further questions, please feel free to contact our team.

Reporting Security Issues

We encourage all users and partners to report potential security vulnerabilities to help us maintain the integrity of Milesight products.

Please submit reports using the following format:

• Subject: Vulnerability Report - [Product Name] - [Brief Summary]
• Submit to: security@milesight.com
• Learn more: Milesight Vulnerability Reporting Policy