This vulnerability in the Milesight MS-Cxx63-PD AIOT camera firmware is caused by weak key generation, which can be exploited to bypass authorization controls. It is tracked as CVE-2026-28747 and classified under CWE-639. The CVSS 4.0 base score is 7.3, indicating high severity, with attack vector being adjacent network, high attack complexity, and requiring privileges and user interaction. No patch or official remediation guidance is currently available from the vendor. The product is not a cloud service, so remediation depends on firmware updates from the vendor.

Successful exploitation of this vulnerability allows an attacker to bypass authorization on affected Milesight AIOT cameras, potentially gaining unauthorized access or control. This could lead to unauthorized device manipulation or data exposure. However, exploitation requires specific conditions including adjacent network access, high attack complexity, privileges, and user interaction. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is available, users should monitor vendor communications for updates. Until a fix is released, restrict network access to the affected devices to trusted users and networks only, and consider additional compensating controls to limit exposure.