This vulnerability (CVE-2026-32649) is a command injection issue (CWE-78) in the web server of Milesight MS-Cxx63-PD cameras. It affects specific firmware versions (version details unspecified). The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, partial user interaction, and high impact on confidentiality, integrity, and availability. No official fix or patch has been announced yet, and no exploits are known in the wild. The vulnerability allows an attacker with certain privileges to execute arbitrary commands via the web server interface.

Successful exploitation could allow an attacker with high privileges and some user interaction to execute arbitrary commands on the affected device, potentially compromising device confidentiality, integrity, and availability. This could lead to unauthorized control or disruption of the camera's operation. However, no active exploitation has been reported to date.

No official patch or remediation is currently available from the vendor. Users should monitor Milesight's official advisories for updates and apply any released firmware patches promptly. Until a fix is available, limit access to the device's web interface to trusted users and networks to reduce exposure. Since this is not a cloud service, remediation depends on vendor firmware updates.