Milesight vulnerabilities and threats

CVE-2026-29988 is a high-severity vulnerability affecting the NFC interface of multiple Milesight AM102/102L V2 IoT devices. It allows an unauthenticated attacker with physical proximity to retrieve sensitive LoRaWAN keys transmitted in cleartext. These keys include NwkSKey, AppSKey, and D2D keys, which can be exploited to decrypt traffic, forge frames, submit false data, and disrupt legitimate communications.

CVE-2026-20766 is a high-severity out-of-bounds memory access vulnerability affecting specific firmware versions of the Milesight MS-Cxx63-PD AIOT cameras. This vulnerability is classified under CWE-122 and has a CVSS 4.0 base score of 8.6, indicating a significant security risk. The vulnerability allows an unauthenticated attacker to potentially cause memory corruption with high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild at this time. Users of the affected product should monitor vendor advisories for updates and apply patches once available.

CVE-2026-32649 is a command injection vulnerability in the web server of certain firmware versions of the Milesight MS-Cxx63-PD camera. This flaw allows an attacker with high privileges and partial user interaction to execute arbitrary commands on the affected device. The vulnerability has a high severity score of 7.3 according to CVSS 4.0 metrics. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Certain firmware versions of the Milesight MS-Cxx63-PD AIOT cameras use SSL certificates that rely on default private keys. This vulnerability, identified as CWE-321, exposes the devices to potential compromise of encrypted communications. The CVSS 4.0 score of 9.2 indicates a critical severity due to network attack vector, low attack complexity, and no required privileges or user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Milesight MS-Cxx63-PD AIOT cameras in specific firmware versions contain hard-coded credentials, which represent a security vulnerability. This issue is tracked as CVE-2026-27785 and is classified under CWE-798. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.7. There is no official patch or remediation level currently indicated by the vendor or advisory. No known exploits in the wild have been reported to date.

CVE-2026-28747 is a high-severity vulnerability affecting specific firmware versions of the Milesight MS-Cxx63-PD AIOT cameras. It involves a weak key generation flaw that allows an attacker to bypass authorization mechanisms. The vulnerability is identified as CWE-639, which relates to authorization bypass due to improper key management. There is no official patch or remediation level currently available, and no known exploits have been reported in the wild. The vulnerability requires high attack complexity and privileges but can be triggered with user interaction. The affected product is not a cloud service, so remediation depends on vendor firmware updates.

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability.

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the remote_subnet field of the database

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the trace tool utility.

Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the ping tool utility.

Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet.

Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a TCP packet.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables when action is 2.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the old_remote_subnet and the old_remote_mask variables.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_ike_profile function with the secrets_local variable.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_dmvpn function with the cisco_secret variable.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_pptp function with the remote_subnet and the remote_mask variables.

Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the username and the password variables.