VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability
CERT warns Norwegian Cruise Line door readers accept cloned RFID UIDs, allowing forged keycards into restricted ship areas.
CERT/CC published VU#676317 for CVE-2026-75907, an improper authentication flaw in door access controllers used on Norwegian Cruise Line ships. Readers accept NFC credentials based only on a static 7-byte UID and do not inspect NTAG212 memory that holds a printed serial and a signature-like value. Someone briefly near a valid card can capture the UID and copy it to an inexpensive writable card that the readers treat as genuine. CERT could not coordinate with the vendor and suggests RFID-blocking sleeves, foil shielding, and keeping cards away from other people and devices.
- CVE-2026-75907: NCL door readers check only a static 7-byte NFC UID.
- A nearby attacker can capture the UID and clone it onto a writable card.
- Readers ignore NTAG212 memory holding a serial and signature-like value.
- CERT could not reach the vendor and recommends RFID shielding.
- CVEs
- CVE-2026-75907
- Tags
- rfidnfcaccess-controlimproper-authenticationcve-2026-75907norwegian-cruise-linephysical-security
- Products
- NTAG212
- Organizations
- Norwegian Cruise LineCERT Coordination Center
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75907 | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip | 7.5 | — |
From the original article
2 min read at kb.cert.orgOverview Door access controllers used on Norwegian Cruise Line (NCL) ships contain an improper authentication vulnerability that permits a replayed unique identifer (UID) from a radio-frequency identification (RFID) device to grant unauthorized entry to areas secured by these controllers. Description Norwegian Cruise Line is a global cruise company that operates a modern fleet sailing to destinations worldwide.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.