CVE-2023-30466: Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-28 · updated 2026-06-17
Weakness: CWE-640

Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.

Affected products

Milesight Ms-N1004-Uc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N1004-Upc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N1008-Uc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N1008-Unc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N1008-Unpc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N1008-Upc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N5008-E Firmware: before 75.9.0.18-r2 — fixed in 75.9.0.18-r2
Milesight Ms-N5008-Pe Firmware: before 75.9.0.18-r2 — fixed in 75.9.0.18-r2
Milesight Ms-N5008-Uc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N5008-Upc Firmware: before 73.9.0.18-r2 — fixed in 73.9.0.18-r2
Milesight Ms-N5016-E Firmware: before 75.9.0.18-r2 — fixed in 75.9.0.18-r2
Milesight Ms-N5016-Pe Firmware: before 75.9.0.18-r2 — fixed in 75.9.0.18-r2
Milesight Ms-N7016-Uh Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N7016-Uph Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N7032-Uh Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N7032-Uph Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N7048-Uph Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N8032-Uh Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-N8064-Uh Firmware: before 71.9.0.18-r2 — fixed in 71.9.0.18-r2
Milesight Ms-Nxxxx-Xxg Firmware: before 77.9.0.18-r2 — fixed in 77.9.0.18-r2
Milesight Ms-Nxxxx-Xxt Firmware: before 72.9.0.18-r2 — fixed in 72.9.0.18-r2

How to fix

Upgrade to a fixed version: Milesight Ms-N1004-Uc Firmware 73.9.0.18-r2; Milesight Ms-N1004-Upc Firmware 73.9.0.18-r2; Milesight Ms-N1008-Uc Firmware 73.9.0.18-r2; Milesight Ms-N1008-Unc Firmware 73.9.0.18-r2; Milesight Ms-N1008-Unpc Firmware 73.9.0.18-r2; Milesight Ms-N1008-Upc Firmware 73.9.0.18-r2; Milesight Ms-N5008-E Firmware 75.9.0.18-r2; Milesight Ms-N5008-Pe Firmware 75.9.0.18-r2; Milesight Ms-N5008-Uc Firmware 73.9.0.18-r2; Milesight Ms-N5008-Upc Firmware 73.9.0.18-r2; Milesight Ms-N5016-E Firmware 75.9.0.18-r2; Milesight Ms-N5016-Pe Firmware 75.9.0.18-r2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-30466 or the next vulnerability affects your stack