CVE-2026-27785

HighCVSS 8.8/10Last modified Jul 25, 2026

Description

Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MilesightMS-Cxx63-PD<= 51.7.0.77-r12
MilesightMS-Cxx64-xPD<= 51.7.0.77-r12
MilesightMS-Cxx73-xPD<= 51.7.0.77-r12
MilesightMS-Cxx75-xxPD<= 51.7.0.77-r12
MilesightMS-Cxx83-xPD<= 51.7.0.77-r12
MilesightMS-Cxx74-PA<= 3x.8.0.3-r11
MilesightMS-C8477-HPG1<= 63.8.0.4-r3
MilesightMS-C8477-PC<= 48.8.0.4-r3
MilesightMS-C5321-FPE<= 62.8.0.4-r5
MilesightMS-Cxx72-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx62-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx52-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxGPE<= 61.8.0.5-r2
MilesightMS-Cxx61-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx67-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx71-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx41-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx76-PE<= 61.8.0.5-r2
MilesightMS-Cxx65-PE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxG1<= 63.8.0.5-r3
MilesightMS-Cxx62-xxxG1<= 63.8.0.5-r3
MilesightMS-Cxx72-xxxG1<= 63.8.0.5-r3
MilesightMS-CQxx31-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-CQxx68-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-CQxx72-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-Nxxxx-NxE<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxC<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxE<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxG<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxH<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxT<= 7x.9.0.19-r5
MilesightPMC8266-FPE<= PO_61.8.0.4_LPR
MilesightPMC8266-FGPE<= PO_61.8.0.4_LPR
MilesightPM3322-E<= PI_61.8.0.3_LPR-r3
MilesightTS4466-X4RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS5366-X12RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-X4RIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-RFIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-RFIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-X4RIWG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIWG1<= T_63.8.0.4_LPR-r3
MilesightTS5510-GVH<= T_47.8.0.4_LPR-r7
MilesightTS5510-GH<= T_47.8.0.4_LPR-r6
MilesightTS5511-GVH<= T_47.8.0.4_LPR-r6
MilesightTS2966-X12TPE<= T_61.8.0.4_LPR-r3
MilesightTS4466-X4RPE<= T_61.8.0.4_LPR-r3
MilesightTS5366-X12PE<= T_61.8.0.4_LPR-r3

References

Timeline

Published
Apr 28, 2026
Last modified
Jul 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-277875.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be exCVE-2026-277888.5Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerabiCVE-2026-27799.8Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird CVE-2026-277902.7Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqCVE-2026-277925.4Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been ideCVE-2026-277936.5Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the `GET /api/v1/user/:id`CVE-2026-277946.6LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability eCVE-2026-277957.4LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) CVE-2026-277967.5Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, alCVE-2026-277975.3Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a reCVE-2026-277987.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a hCVE-2026-277994.4ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a h
CVE-2026-27785: High severity, CVSS 8.8 | Vulnix