CVE-2026-28747 Milesight Cameras Authorization Bypass Through User-Controlled Key
A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
Problem types: cwe_id: CWE-639
description: CWE-639
Affected products: vendor: Milesight
product: MS-Cxx63-PD
default_status: unaffected
vendor: Milesight
product: MS-Cxx64-xPD
default_status: unaffected
vendor: Milesight
product: MS-Cxx73-xPD
default_status: unaffected
vendor: Milesight
product: MS-Cxx75-xxPD
default_status: unaffected
vendor: Milesight
product: MS-Cxx83-xPD
default_status: unaffected
vendor: Milesight
product: MS-Cxx74-PA
default_status: unaffected
vendor: Milesight
product: MS-C8477-HPG1
default_status: unaffected
vendor: Milesight
product: MS-C8477-PC
default_status: unaffected
vendor: Milesight
product: MS-C5321-FPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx72-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx62-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx52-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-xxxGPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx61-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx67-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx71-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx41-xxxPE
default_status: unaffected
vendor: Milesight
product: MS-Cxx76-PE
default_status: unaffected
vendor: Milesight
product: MS-Cxx65-PE
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-Cxx62-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-Cxx72-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-CQxx31-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-CQxx68-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-CQxx72-xxxG1
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-NxE
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-xxC
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-xxE
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-xxG
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-xxH
default_status: unaffected
vendor: Milesight
product: MS-Nxxxx-xxT
default_status: unaffected
vendor: Milesight
product: PMC8266-FPE
default_status: unaffected
vendor: Milesight
product: PMC8266-FGPE
default_status: unaffected
vendor: Milesight
product: PM3322-E
default_status: unaffected
vendor: Milesight
product: TS4466-X4RIPG1
default_status: unaffected
vendor: Milesight
product: TS5366-X12RIPG1
default_status: unaffected
vendor: Milesight
product: TS8266-X4RIPG1
default_status: unaffected
vendor: Milesight
product: TS4466-X4RIVPG1
default_status: unaffected
vendor: Milesight
product: TS4466-RFIVPG1
default_status: unaffected
vendor: Milesight
product: TS8266-X4RIVPG1
default_status: unaffected
vendor: Milesight
product: TS8266-RFIVPG1
default_status: unaffected
vendor: Milesight
product: TS4466-X4RIWG1
default_status: unaffected
vendor: Milesight
product: TS8266-X4RIWG1
default_status: unaffected
vendor: Milesight
product: TS5510-GVH
default_status: unaffected
vendor: Milesight
product: TS5510-GH
default_status: unaffected
vendor: Milesight
product: TS5511-GVH
default_status: unaffected
vendor: Milesight
product: TS2966-X12TPE
default_status: unaffected
vendor: Milesight
product: TS4466-X4RPE
default_status: unaffected
vendor: Milesight
product: TS5366-X12PE
default_status: unaffected
vendor: Milesight
product: TS8266-X4PE
default_status: unaffected
vendor: Milesight
product: TS2966-X12TVPE
default_status: unaffected
vendor: Milesight
product: TS4466-X4RVPE
default_status: unaffected
vendor: Milesight
product: TS5366-X12VPE
default_status: unaffected
vendor: Milesight
product: TS8266-X4VPE
default_status: unaffected
vendor: Milesight
product: TS4441-X36RPE
default_status: unaffected
vendor: Milesight
product: TS4441-X36RE
default_status: unaffected
vendor: Milesight
product: TS4466-X4RWE
default_status: unaffected
vendor: Milesight
product: TS8266-X4WE
default_status: unaffected
vendor: Milesight
product: MS-C2964-RFLPC
default_status: unaffected
vendor: Milesight
product: MS-C2972-RFLPC
default_status: unaffected
vendor: Milesight
product: MS-C2966-RFLWPC
default_status: unaffected
vendor: Milesight
product: TS2866-X4TPC
default_status: unaffected
vendor: Milesight
product: TS2866-X4TVPC
default_status: unaffected
vendor: Milesight
product: TS2866-X4TGPC
default_status: unaffected
vendor: Milesight
product: TS2841-X36TPC
default_status: unaffected
vendor: Milesight
product: TS2841-X36TPC/W
default_status: unaffected
vendor: Milesight
product: TS2867-X5TPC
default_status: unaffected
vendor: Milesight
product: TS2961-X12TPC
default_status: unaffected
vendor: Milesight
product: TS8266-FPC/P
default_status: unaffected
vendor: Milesight
product: MS-C2966-X12RLPC
default_status: unaffected
vendor: Milesight
product: MS-C2966-X12RLVPC
default_status: unaffected
vendor: Milesight
product: MS-C5366-X12LPC
default_status: unaffected
vendor: Milesight
product: MS-C5366-X12LVPC
default_status: unaffected
vendor: Milesight
product: MS-C5361-X12LPC
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-xxxxGOPC
default_status: unaffected
vendor: Milesight
product: SC211
default_status: unaffected
vendor: Milesight
product: SP111
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-RFIPKG1
default_status: unaffected
vendor: Milesight
product: MS-Cxx72-RFIPKG1
default_status: unaffected
vendor: Milesight
product: MS-Cxx66-FIPKG1
default_status: unaffected
vendor: Milesight
product: MS-Cxx72-FIPKG1
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Souvik Kandar reported these vulnerabilities to CISA
Published: 2026-04-27T22:44:52.012Z