What’s Vulnerable › Vulnerabilities
CVE-2026-28747: Milesight Cameras Authorization Bypass Through User-Controlled Key
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-27 · updated 2026-07-25
- Weakness: CWE-639
Description
A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
Affected products
- Milesight MS-C2964-RFLPC: through T_45.8.0.3-r9
- Milesight MS-C2966-RFLWPC: through T_45.8.0.3-r9
- Milesight MS-C2966-X12RLPC: through T_45.8.0.3-r9
- Milesight MS-C2966-X12RLVPC: through T_45.8.0.3-r9
- Milesight MS-C2972-RFLPC: through T_45.8.0.3-r9
- Milesight MS-C5321-FPE: through 62.8.0.4-r5
- Milesight MS-C5361-X12LPC: through T_45.8.0.3-r9
- Milesight MS-C5366-X12LPC: through T_45.8.0.3-r9
- Milesight MS-C5366-X12LVPC: through T_45.8.0.3-r9
- Milesight MS-C8477-HPG1: through 63.8.0.4-r3
- Milesight MS-C8477-PC: through 48.8.0.4-r3
- Milesight MS-CQxx31-xxxG1: through CQ_63.8.0.5-r1
- Milesight MS-CQxx68-xxxG1: through CQ_63.8.0.5-r1
- Milesight MS-CQxx72-xxxG1: through CQ_63.8.0.5-r1
- Milesight MS-Cxx41-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx52-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx61-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx62-xxxG1: through 63.8.0.5-r3
- Milesight MS-Cxx62-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx63-PD: through 51.7.0.77-r12
- Milesight MS-Cxx64-xPD: through 51.7.0.77-r12
- Milesight MS-Cxx65-PE: through 61.8.0.5-r2
- Milesight MS-Cxx66-FIPKG1: through 63.8.0.4-r1-NX
- Milesight MS-Cxx66-RFIPKG1: through 63.8.0.4-r1-NX
- Milesight MS-Cxx66-xxxG1: through 63.8.0.5-r3
- Milesight MS-Cxx66-xxxGPE: through 61.8.0.5-r2
- Milesight MS-Cxx66-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx66-xxxxGOPC: through 45.8.0.2-AIoT-r4
- Milesight MS-Cxx67-xxxPE: through 61.8.0.5-r2
- Milesight MS-Cxx71-xxxPE: through 61.8.0.5-r2
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.json
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03
- https://www.milesight.com/support/download/firmware
Get alerted when CVE-2026-28747 or the next vulnerability affects your stack