Executive brief
A large number of Milesight AIOT cameras contain hard-coded login credentials within their firmware. These cameras are used for security surveillance and industrial monitoring. An attacker with access to the local network could use these permanent credentials to gain full control over the camera, potentially leading to unauthorized surveillance, data theft, or further network intrusion.
Technical details
A hard-coded credentials vulnerability (CWE-798) exists in multiple Milesight AIOT camera models and firmware versions. The flaw allows an attacker with adjacent network access to authenticate to the device without a unique password. Successful exploitation can lead to full device compromise, including remote code execution or device crashes. The vulnerability was disclosed alongside several other flaws (CVE-2026-28747, CVE-2026-32644, etc.) in a coordinated ICS advisory. Users are advised to update to the latest firmware versions provided by Milesight to mitigate this risk.
Affected products
- Milesight MS-Cxx63-PD <=51.7.0.77-r12
- Milesight MS-Cxx64-xPD <=51.7.0.77-r12
- Milesight MS-Cxx73-xPD <=51.7.0.77-r12
- Milesight MS-Cxx75-xxPD <=51.7.0.77-r12
- Milesight MS-Cxx83-xPD <=51.7.0.77-r12
- Milesight MS-Cxx74-PA <=3x.8.0.3-r11
- Milesight MS-C8477-HPG1 <=63.8.0.4-r3
- Milesight MS-C8477-PC <=48.8.0.4-r3
- Milesight MS-C5321-FPE <=62.8.0.4-r5
- Milesight MS-Cxx72-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx62-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx52-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxGPE <=61.8.0.5-r2
- Milesight MS-Cxx61-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx67-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx71-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx41-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx76-PE <=61.8.0.5-r2
- Milesight MS-Cxx65-PE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxG1 <=63.8.0.5-r3
- Milesight MS-Cxx62-xxxG1 <=63.8.0.5-r3
- Milesight MS-Cxx72-xxxG1 <=63.8.0.5-r3
- Milesight MS-CQxx31-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-CQxx68-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-CQxx72-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-Nxxxx-NxE <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxC <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxE <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxG <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxH <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxT <=7x.9.0.19-r5
- Milesight PMC8266-FPE <=PO_61.8.0.4_LPR
- Milesight PMC8266-FGPE <=PO_61.8.0.4_LPR
- Milesight PM3322-E <=PI_61.8.0.3_LPR-r3
- Milesight TS4466-X4RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS5366-X12RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-X4RIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-RFIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-RFIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-X4RIWG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIWG1 <=T_63.8.0.4_LPR-r3
- Milesight TS5510-GVH <=T_47.8.0.4_LPR-r7
- Milesight TS5510-GH <=T_47.8.0.4_LPR-r6
- Milesight TS5511-GVH <=T_47.8.0.4_LPR-r6
- Milesight TS2966-X12TPE <=T_61.8.0.4_LPR-r3
- Milesight TS4466-X4RPE <=T_61.8.0.4_LPR-r3
- Milesight TS5366-X12PE <=T_61.8.0.4_LPR-r3
- Milesight TS8266-X4PE <=T_61.8.0.4_LPR-r3
- Milesight TS2966-X12TVPE <=T_61.8.0.4_LPR-r3
- Milesight TS4466-X4RVPE <=T_61.8.0.4_LPR-r3
- Milesight TS5366-X12VPE <=T_61.8.0.4_LPR-r3
- Milesight TS8266-X4VPE <=T_61.8.0.4_LPR-r3
- Milesight TS4441-X36RPE <=T_61.8.0.4_LPR-r3
- Milesight TS4441-X36RE <=T_61.8.0.4_LPR-r3
- Milesight,versions: TS4466-X4RWE
- Milesight,versions: TS8266-X4WE
- Milesight AIOT camera firmware Specific versions
Timeline
- 2026-04-23: advisory: CISA ICS Advisory ICSA-26-113-03 released
- 2026-04-28: disclosed: NVD publication date