Executive brief
A large number of Milesight AIOT cameras use default, hard-coded private keys for their SSL certificates. These cameras are used for security surveillance and industrial monitoring. An attacker can use these known keys to intercept encrypted traffic, impersonate the camera, or potentially gain unauthorized access to the device and its video feeds.
Technical details
Milesight AIOT cameras are vulnerable to CWE-321 (Use of Hard-coded Cryptographic Key) because specific firmware versions utilize SSL certificates with default private keys. This vulnerability is network-reachable and requires no authentication or user interaction. An attacker possessing the default private key can perform man-in-the-middle (MitM) attacks to decrypt HTTPS traffic, or potentially leverage this and other concurrent vulnerabilities in the firmware to achieve remote code execution. Users are advised to update to the latest firmware versions available on the Milesight support website.
Affected products
- Milesight MS-Cxx63-PD <=51.7.0.77-r12
- Milesight MS-Cxx64-xPD <=51.7.0.77-r12
- Milesight MS-Cxx73-xPD <=51.7.0.77-r12
- Milesight MS-Cxx75-xxPD <=51.7.0.77-r12
- Milesight MS-Cxx83-xPD <=51.7.0.77-r12
- Milesight MS-Cxx74-PA <=3x.8.0.3-r11
- Milesight MS-C8477-HPG1 <=63.8.0.4-r3
- Milesight MS-C8477-PC <=48.8.0.4-r3
- Milesight MS-C5321-FPE <=62.8.0.4-r5
- Milesight MS-Cxx72-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx62-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx52-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxGPE <=61.8.0.5-r2
- Milesight MS-Cxx61-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx67-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx71-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx41-xxxPE <=61.8.0.5-r2
- Milesight MS-Cxx76-PE <=61.8.0.5-r2
- Milesight MS-Cxx65-PE <=61.8.0.5-r2
- Milesight MS-Cxx66-xxxG1 <=63.8.0.5-r3
- Milesight MS-Cxx62-xxxG1 <=63.8.0.5-r3
- Milesight MS-Cxx72-xxxG1 <=63.8.0.5-r3
- Milesight MS-CQxx31-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-CQxx68-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-CQxx72-xxxG1 <=CQ_63.8.0.5-r1
- Milesight MS-Nxxxx-NxE <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxC <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxE <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxG <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxH <=7x.9.0.19-r5
- Milesight MS-Nxxxx-xxT <=7x.9.0.19-r5
- Milesight PMC8266-FPE <=PO_61.8.0.4_LPR
- Milesight PMC8266-FGPE <=PO_61.8.0.4_LPR
- Milesight PM3322-E <=PI_61.8.0.3_LPR-r3
- Milesight TS4466-X4RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS5366-X12RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-X4RIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-RFIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-RFIVPG1 <=T_63.8.0.4_LPR-r3
- Milesight TS4466-X4RIWG1 <=T_63.8.0.4_LPR-r3
- Milesight TS8266-X4RIWG1 <=T_63.8.0.4_LPR-r3
- Milesight TS5510-GVH <=T_47.8.0.4_LPR-r7
- Milesight TS5510-GH <=T_47.8.0.4_LPR-r6
- Milesight TS5511-GVH <=T_47.8.0.4_LPR-r6
- Milesight TS2966-X12TPE <=T_61.8.0.4_LPR-r3
- Milesight TS4466-X4RPE <=T_61.8.0.4_LPR-r3
- Milesight TS5366-X12PE <=T_61.8.0.4_LPR-r3
- Milesight TS8266-X4PE <=T_61.8.0.4_LPR-r3
- Milesight TS2966-X12TVPE <=T_61.8.0.4_LPR-r3
- Milesight TS4466-X4RVPE <=T_61.8.0.4_LPR-r3
- Milesight TS5366-X12VPE <=T_61.8.0.4_LPR-r3
- Milesight TS8266-X4VPE <=T_61.8.0.4_LPR-r3
- Milesight TS4441-X36RPE <=T_61.8.0.4_LPR-r3
- Milesight TS4441-X36RE <=T_61.8.0.4_LPR-r3
- Milesight TS4466-X4RWE <=T_61.8.0.4_LPR-r3
- Milesight,versions: TS8266-X4WE
Timeline
- 2026-04-23: advisory: Initial CISA ICS Advisory released.
- 2026-04-28: disclosed: CVE published to NVD.