Norwegian Cruise Line Ship Doors Accept Cloned Keycards

A copied keycard identifier can open restricted doors on Norwegian Cruise Line ships. In its September 24 vulnerability note, CERT/CC says affected door readers accept a static, seven-byte NFC identifier as the entire access check. The reader ignores the card memory containing a printed serial number and a signature-like value. A duplicate card can put crew operations and guest safety at risk.

Ship operators need to identify readers that still accept copied identifiers. CERT/CC credits Mark Linton with reporting the issue, tracked as CVE-2026-75907.

A serial number opens the door

A card UID identifies the chip; it does not authenticate the person carrying it. The CVE Program record, assigned by CERT/CC, says the UID is transmitted in clear text when the card is read and the affected access system grants entry on that value alone. An attacker who briefly approaches a valid card can capture its identifier and reproduce a credential the reader accepts. CERT/CC says that duplicate can remain usable as a permanent credential.

NXP lists a manufacturer-programmed seven-byte UID, an ECC originality signature and optional memory-operation password protection on the NTAG 210/212 family. CERT/CC says the affected reader does not inspect the other data during access control. CERT/CC puts it this way: “Validation based solely on UID constitutes identification rather than authentication.” A printed card number or extra tag memory cannot protect a door whose controller decides on the UID alone.

An ordinary entry may hide a duplicate

CERT/CC warns that, depending on logging configuration, entry using a duplicate may look like legitimate use of the original card. An access-control log showing an authorized UID therefore records which number the reader accepted, not which physical card was presented. Investigate suspicious entries by correlating door-event history with staffed access observations.

The reported setting is door controllers used on Norwegian Cruise Line ships. The CVE record lists the affected product version as N/A. Ask the access owner for each relevant reader’s installed controller and authentication behavior, starting with restricted doors where a copied credential would create a safety risk. CERT/CC says it could not reach the vendor to coordinate its note.

Reduce card exposure and guard doors

Start with the credentials crew carry near strangers or unattended readers. CERT/CC recommends RFID-blocking wallets or shielded sleeves, shielding cards with foil, and keeping cards at least 12 inches from other people or devices when feasible. It describes 13.56 MHz cards as ordinarily readable at about 2–5 cm. Those measures reduce opportunities to acquire a UID; they cannot change a UID already copied or give a UID-only reader cryptographic authentication.

For sensitive shipboard areas, ask the access-control owner or integrator which installed readers grant access from the seven-byte UID alone. Until they can document a replacement that authenticates the credential, require a staffed or second, independent access check where the physical risk warrants one. Preserve door events and correlate unusual use of an affected credential with physical observations when investigating an entry.

Keep restricted access accountable

Inventory the restricted doors using UID-only readers, shield the cards issued for those doors, and put a human or independent control on the most consequential entries. Keep the door-event record and staffed observation together when investigating a suspicious entry: the accepted UID alone identifies a number, not the physical card or person. Seek the controller maker’s documented authentication behavior and remediation through your shipboard access owner. For a future replacement, require this expected result from an integrator-supervised acceptance check: matching the seven-byte UID alone never grants entry. Retain the independent check until that behavior is documented and verified.