CVE-2026-32644 affects specific firmware versions of the Milesight MS-Cxx63-PD AIOT cameras by using SSL certificates with default private keys. This cryptographic weakness (CWE-321) undermines the security of SSL/TLS communications, potentially allowing attackers to decrypt or impersonate the device's encrypted traffic. The vulnerability has a critical CVSS 4.0 base score of 9.2, reflecting its high impact and ease of exploitation over the network without privileges or user interaction. No patch or official remediation level has been published, and no exploits are currently known in the wild.

The use of default private keys in SSL certificates compromises the confidentiality and integrity of communications with the affected cameras. Attackers could potentially decrypt intercepted traffic or perform man-in-the-middle attacks, leading to unauthorized access or data exposure. Given the critical CVSS score and network attack vector, this vulnerability poses a significant risk to environments deploying these devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting network exposure of affected devices and monitoring for unusual activity. Avoid deploying affected firmware versions where possible and follow vendor communications for updates.