CVE-2026-75907
Received Received - Intake

Authentication Bypass via NTAG212 UID in Norwegian Cruise Line Access Control

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: CERT/CC

Description
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-75907
EUVD
EUVD-2026-86156

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
norwegian_cruise_line door_access_controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a door access control system on a Norwegian Cruise Line asset that authenticates credentials solely based on a static 7-byte UID stored on an NTAG212 NFC chip. The UID is not a secret and is sent in clear text during each read, making it vulnerable to cloning or replay attacks. The system fails to perform proper authentication, relying only on identification.

Detection Guidance

This vulnerability involves weak authentication using static UIDs from NTAG212 NFC chips. Detection requires checking if your door access controllers rely solely on UID matching without cryptographic validation. Inspect reader configurations and test with an NFC reader to capture and replay UIDs. No specific commands are provided in the context.

Impact Analysis

An attacker with brief physical access to a valid keycard can capture the UID, clone it onto a writable card, and gain unauthorized entry to restricted areas. This could lead to physical access to secure locations on cruise ships, posing safety risks and potential misuse of restricted spaces.

Compliance Impact

This vulnerability does not directly affect GDPR or HIPAA compliance as it pertains to door access control rather than data privacy or healthcare systems. However, unauthorized physical access could potentially lead to breaches of sensitive areas, indirectly impacting security protocols that may be tied to regulatory requirements.

Mitigation Strategies

Use RFID-blocking wallets, shielded card sleeves, or aluminum foil to prevent UID capture. Replace or upgrade access controllers to support challenge-response authentication instead of static UID checks. Avoid storing credentials in plaintext or easily clonable formats.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart