This vulnerability (CVE-2026-32649) affects the web server component of specific firmware versions of the Milesight MS-Cxx63-PD camera. It is classified as a CWE-78 command injection issue, enabling an attacker with high privileges and partial user interaction to execute arbitrary commands remotely over the network. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, partial user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor, and the product is not a cloud service. The vulnerability was published on April 27, 2026, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary commands on the affected camera, potentially leading to full compromise of the device's confidentiality, integrity, and availability. Given the high CVSS score (7.3), the impact is significant, especially in environments relying on these cameras for security or monitoring. However, exploitation requires high privileges and some user interaction, which may limit the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for vendor updates. Until a fix is available, restricting access to the device's web interface to trusted networks and users with appropriate privileges is recommended to reduce exposure.