CVE-2026-75907 Details
Description
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.
A vulnerability exists in the door access control system used by Norwegian Cruise Line (NCL) that allows unauthorized entry by exploiting the system's reliance on static unique identifiers (UIDs) from NTAG212 NFC chips. The access control readers authenticate credentials solely based on these 7-byte UIDs, which are transmitted in clear text and are not intended to be secret. This method of validation constitutes identification rather than authentication, as the UIDs can be easily copied or emulated without any cryptographic protection. The vulnerability arises because the readers do not verify additional data available on the NFC chips that could enhance security.
To mitigate the risk of RFID cloning, users can employ RFID-blocking wallets or shielded card-holder sleeves, place aluminum foil on both sides of the RFID card to create a basic Faraday shield, and maintain a distance of at least 12 inches from other people or devices when using or storing the card.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.kb.cert.org/vuls/id/676317 | CVE | AdvisoryRemedy |
| https://kb.cert.org/vuls/id/676317 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
| CWE-294 | Authentication Bypass by Capture-replay | CISA-ADP |
| CWE-613 | Insufficient Session Expiration | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Norwegian Cruise Line door access controller | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | CVE Modified | CVE |
| Sep 24, 2026 | New CVE Received | [email protected] |