CVE-2026-28747

HighCVSS 7.1/10Last modified Jul 25, 2026

Description

A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MilesightMS-Cxx63-PD<= 51.7.0.77-r12
MilesightMS-Cxx64-xPD<= 51.7.0.77-r12
MilesightMS-Cxx73-xPD<= 51.7.0.77-r12
MilesightMS-Cxx75-xxPD<= 51.7.0.77-r12
MilesightMS-Cxx83-xPD<= 51.7.0.77-r12
MilesightMS-Cxx74-PA<= 3x.8.0.3-r11
MilesightMS-C8477-HPG1<= 63.8.0.4-r3
MilesightMS-C8477-PC<= 48.8.0.4-r3
MilesightMS-C5321-FPE<= 62.8.0.4-r5
MilesightMS-Cxx72-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx62-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx52-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxGPE<= 61.8.0.5-r2
MilesightMS-Cxx61-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx67-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx71-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx41-xxxPE<= 61.8.0.5-r2
MilesightMS-Cxx76-PE<= 61.8.0.5-r2
MilesightMS-Cxx65-PE<= 61.8.0.5-r2
MilesightMS-Cxx66-xxxG1<= 63.8.0.5-r3
MilesightMS-Cxx62-xxxG1<= 63.8.0.5-r3
MilesightMS-Cxx72-xxxG1<= 63.8.0.5-r3
MilesightMS-CQxx31-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-CQxx68-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-CQxx72-xxxG1<= CQ_63.8.0.5-r1
MilesightMS-Nxxxx-NxE<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxC<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxE<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxG<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxH<= 7x.9.0.19-r5
MilesightMS-Nxxxx-xxT<= 7x.9.0.19-r5
MilesightPMC8266-FPE<= PO_61.8.0.4_LPR
MilesightPMC8266-FGPE<= PO_61.8.0.4_LPR
MilesightPM3322-E<= PI_61.8.0.3_LPR-r3
MilesightTS4466-X4RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS5366-X12RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-X4RIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-RFIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-RFIVPG1<= T_63.8.0.4_LPR-r3
MilesightTS4466-X4RIWG1<= T_63.8.0.4_LPR-r3
MilesightTS8266-X4RIWG1<= T_63.8.0.4_LPR-r3
MilesightTS5510-GVH<= T_47.8.0.4_LPR-r7
MilesightTS5510-GH<= T_47.8.0.4_LPR-r6
MilesightTS5511-GVH<= T_47.8.0.4_LPR-r6
MilesightTS2966-X12TPE<= T_61.8.0.4_LPR-r3
MilesightTS4466-X4RPE<= T_61.8.0.4_LPR-r3
MilesightTS5366-X12PE<= T_61.8.0.4_LPR-r3

References

Timeline

Published
Apr 27, 2026
Last modified
Jul 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-287513.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-287533.7NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DCVE-2026-287544.8Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.CVE-2026-287555.4NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificatCVE-2026-287564.8Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups rCVE-2026-287576.7Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalationCVE-2026-287584.4When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password paraCVE-2026-287594.3Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel bCVE-2026-28768.8A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. ThCVE-2026-287608.4The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to plaCVE-2026-287618.5Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a useCVE-2026-287639.1A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R
CVE-2026-28747: High severity, CVSS 7.1 | Vulnix