medium
6.8
CVE-2026-32649 json
Milesight Cameras OS Command Injection
published 2026-04-27 6 mo ago modified 2026-07-25 3 mo ago also EUVD-2026-25958
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-26-113-03 updated cvss 6.8
Milesight Cameras
-
Milesight MS-C2964-RFLPC <=T_45.8.0.3-r9 Milesight MS-C2966-RFLWPC <=T_45.8.0.3-r9 Milesight MS-C2966-X12RLPC <=T_45.8.0.3-r9 Milesight MS-C2966-X12RLVPC <=T_45.8.0.3-r9 Milesight MS-C2972-RFLPC <=T_45.8.0.3-r9affected: vendor fix, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-C5321-FPE <=62.8.0.4-r5affected: fixed in 62.8.0.4-r6, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-C5361-X12LPC <=T_45.8.0.3-r9 Milesight MS-C5366-X12LPC <=T_45.8.0.3-r9 Milesight MS-C5366-X12LVPC <=T_45.8.0.3-r9affected: vendor fix, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-C8477-HPG1 <=63.8.0.4-r3affected: fixed in 63.8.0.4-r4, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-C8477-PC <=48.8.0.4-r3affected: fixed in 48.8.0.4-r4, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-CQxx31-xxxG1 <=CQ_63.8.0.5-r1 Milesight MS-CQxx68-xxxG1 <=CQ_63.8.0.5-r1 Milesight MS-CQxx72-xxxG1 <=CQ_63.8.0.5-r1affected: vendor fix, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx41-xxxPE <=61.8.0.5-r2 Milesight MS-Cxx52-xxxPE <=61.8.0.5-r2 Milesight MS-Cxx61-xxxPE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx62-xxxG1 <=63.8.0.5-r3affected: fixed in 63.8.0.5-r4, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
show 17 moreshow fewer
-
Milesight MS-Cxx62-xxxPE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx63-PD <=51.7.0.77-r12 Milesight MS-Cxx64-xPD <=51.7.0.77-r12affected: fixed in 51.7.0.77-r13, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx65-PE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx66-FIPKG1 <=63.8.0.4-r1-NX Milesight MS-Cxx66-RFIPKG1 <=63.8.0.4-r1-NXaffected: fixed in 63.8.0.5-r2-NX, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx66-xxxG1 <=63.8.0.5-r3affected: fixed in 63.8.0.5-r4, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx66-xxxGPE <=61.8.0.5-r2 Milesight MS-Cxx66-xxxPE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx66-xxxxGOPC <=45.8.0.2-AIoT-r4affected: fixed in 45.8.0.2-AIoT-r5, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx67-xxxPE <=61.8.0.5-r2 Milesight MS-Cxx71-xxxPE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx72-FIPKG1 <=63.8.0.4-r1-NX Milesight MS-Cxx72-RFIPKG1 <=63.8.0.4-r1-NXaffected: fixed in 63.8.0.5-r2-NX, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx72-xxxG1 <=63.8.0.5-r3affected: fixed in 63.8.0.5-r4, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx72-xxxPE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx73-xPD <=51.7.0.77-r12affected: fixed in 51.7.0.77-r13, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx74-PA <=3x.8.0.3-r11affected: fixed in 3x.8.0.3-r13, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx75-xxPD <=51.7.0.77-r12affected: fixed in 51.7.0.77-r13, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx76-PE <=61.8.0.5-r2affected: fixed in 61.8.0.5-r2, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Cxx83-xPD <=51.7.0.77-r12affected: fixed in 51.7.0.77-r13, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
-
Milesight MS-Nxxxx-NxE <=7x.9.0.19-r5affected: fixed in 7x.9.0.19-r6, mitigation “Milesight advises all users to update their device to the latest firmware versions of PE/PC/PA found at https://www.milesight.com/support/download/firmware.” milesight.com
42 more affected in the full advisory
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Milesight MS-Cxx63-PD
- Milesight MS-Cxx64-xPD
- Milesight MS-Cxx73-xPD
- Milesight MS-Cxx75-xxPD
- Milesight MS-Cxx83-xPD
- Milesight MS-Cxx74-PA
- Milesight MS-C8477-HPG1
- Milesight MS-C8477-PC
- Milesight MS-C5321-FPE
- Milesight MS-Cxx72-xxxPE
- Milesight MS-Cxx62-xxxPE
- Milesight MS-Cxx52-xxxPE
- Milesight MS-Cxx66-xxxPE
- Milesight MS-Cxx66-xxxGPE
- Milesight MS-Cxx61-xxxPE
- Milesight MS-Cxx67-xxxPE
- Milesight MS-Cxx71-xxxPE
- Milesight MS-Cxx41-xxxPE
- Milesight MS-Cxx76-PE
- Milesight MS-Cxx65-PE
- Milesight MS-Cxx66-xxxG1
- Milesight MS-Cxx62-xxxG1
- Milesight MS-Cxx72-xxxG1
- Milesight MS-CQxx31-xxxG1
- Milesight MS-CQxx68-xxxG1
- Milesight MS-CQxx72-xxxG1
- Milesight MS-Nxxxx-NxE
- Milesight MS-Nxxxx-xxC
- Milesight MS-Nxxxx-xxE
- Milesight MS-Nxxxx-xxG
- Milesight MS-Nxxxx-xxH
- Milesight MS-Nxxxx-xxT
- Milesight PMC8266-FPE
- Milesight PMC8266-FGPE
- Milesight PM3322-E
- Milesight TS4466-X4RIPG1
- Milesight TS5366-X12RIPG1
- Milesight TS8266-X4RIPG1
- Milesight TS4466-X4RIVPG1
- Milesight TS4466-RFIVPG1
- Milesight TS8266-X4RIVPG1
- Milesight TS8266-RFIVPG1
- Milesight TS4466-X4RIWG1
- Milesight TS8266-X4RIWG1
- Milesight TS5510-GVH
- Milesight TS5510-GH
- Milesight TS5511-GVH
- Milesight TS2966-X12TPE
- Milesight TS4466-X4RPE
- Milesight TS5366-X12PE
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
Sources
- CVE List CVE-2026-32649
- NVD CVE-2026-32649
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.