CVE-2026-32644 affects specific firmware versions of the Milesight MS-Cxx63-PD AIOT cameras, where SSL certificates are implemented using default private keys. This cryptographic weakness (CWE-321) undermines the confidentiality and integrity of communications secured by these certificates. The vulnerability has a CVSS 4.0 score of 9.2, reflecting its critical impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

The use of default private keys in SSL certificates can allow attackers to decrypt, intercept, or manipulate encrypted communications with the affected devices. This compromises the confidentiality and integrity of data transmitted by the cameras. Given the critical CVSS score, successful exploitation could lead to significant security breaches. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting exposure of affected devices to untrusted networks and monitor for updates from Milesight regarding firmware updates or security advisories.