Description (CNA)
A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Milesight / MS-Cxx63-PD | affected 0 through 51.7.0.77-r12 |
| Milesight / MS-Cxx64-xPD | affected 0 through 51.7.0.77-r12 |
| Milesight / MS-Cxx73-xPD | affected 0 through 51.7.0.77-r12 |
| Milesight / MS-Cxx75-xxPD | affected 0 through 51.7.0.77-r12 |
| Milesight / MS-Cxx83-xPD | affected 0 through 51.7.0.77-r12 |
| Milesight / MS-Cxx74-PA | affected 0 through 3x.8.0.3-r11 |
| Milesight / MS-C8477-HPG1 | affected 0 through 63.8.0.4-r3 |
| Milesight / MS-C8477-PC | affected 0 through 48.8.0.4-r3 |
| Milesight / MS-C5321-FPE | affected 0 through 62.8.0.4-r5 |
| Milesight / MS-Cxx72-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx62-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx52-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx66-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx66-xxxGPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx61-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx67-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx71-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx41-xxxPE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx76-PE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx65-PE | affected 0 through 61.8.0.5-r2 |
| Milesight / MS-Cxx66-xxxG1 | affected 0 through 63.8.0.5-r3 |
| Milesight / MS-Cxx62-xxxG1 | affected 0 through 63.8.0.5-r3 |
| Milesight / MS-Cxx72-xxxG1 | affected 0 through 63.8.0.5-r3 |
| Milesight / MS-CQxx31-xxxG1 | affected 0 through CQ_63.8.0.5-r1 |
| Milesight / MS-CQxx68-xxxG1 | affected 0 through CQ_63.8.0.5-r1 |
| Milesight / MS-CQxx72-xxxG1 | affected 0 through CQ_63.8.0.5-r1 |
| Milesight / MS-Nxxxx-NxE | affected 0 through 7x.9.0.19-r5 |
| Milesight / MS-Nxxxx-xxC | affected 0 through 7x.9.0.19-r5 |
| Milesight / MS-Nxxxx-xxE | affected 0 through 7x.9.0.19-r5 |
| Milesight / MS-Nxxxx-xxG | affected 0 through 7x.9.0.19-r5 |
| Milesight / MS-Nxxxx-xxH | affected 0 through 7x.9.0.19-r5 |
| Milesight / MS-Nxxxx-xxT | affected 0 through 7x.9.0.19-r5 |
| Milesight / PMC8266-FPE | affected 0 through PO_61.8.0.4_LPR |
| Milesight / PMC8266-FGPE | affected 0 through PO_61.8.0.4_LPR |
| Milesight / PM3322-E | affected 0 through PI_61.8.0.3_LPR-r3 |
| Milesight / TS4466-X4RIPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS5366-X12RIPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS8266-X4RIPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS4466-X4RIVPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS4466-RFIVPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS8266-X4RIVPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS8266-RFIVPG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS4466-X4RIWG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS8266-X4RIWG1 | affected 0 through T_63.8.0.4_LPR-r3 |
| Milesight / TS5510-GVH | affected 0 through T_47.8.0.4_LPR-r7 |
| Milesight / TS5510-GH | affected 0 through T_47.8.0.4_LPR-r6 |
| Milesight / TS5511-GVH | affected 0 through T_47.8.0.4_LPR-r6 |
| Milesight / TS2966-X12TPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS4466-X4RPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS5366-X12PE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS8266-X4PE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS2966-X12TVPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS4466-X4RVPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS5366-X12VPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS8266-X4VPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS4441-X36RPE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS4441-X36RE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS4466-X4RWE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / TS8266-X4WE | affected 0 through T_61.8.0.4_LPR-r3 |
| Milesight / MS-C2964-RFLPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C2972-RFLPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C2966-RFLWPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2866-X4TPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2866-X4TVPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2866-X4TGPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2841-X36TPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2841-X36TPC/W | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2867-X5TPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS2961-X12TPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / TS8266-FPC/P | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C2966-X12RLPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C2966-X12RLVPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C5366-X12LPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C5366-X12LVPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-C5361-X12LPC | affected 0 through T_45.8.0.3-r9 |
| Milesight / MS-Cxx66-xxxxGOPC | affected 0 through 45.8.0.2-AIoT-r4 |
| Milesight / SC211 | affected 0 through C_21.1.0.8-r4 |
| Milesight / SP111 | affected 0 through 52.8.0.4-r5 |
| Milesight / MS-Cxx66-RFIPKG1 | affected 0 through 63.8.0.4-r1-NX |
| Milesight / MS-Cxx72-RFIPKG1 | affected 0 through 63.8.0.4-r1-NX |
| Milesight / MS-Cxx66-FIPKG1 | affected 0 through 63.8.0.4-r1-NX |
| Milesight / MS-Cxx72-FIPKG1 | affected 0 through 63.8.0.4-r1-NX |
CWE
CWE-639
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.json
- https://www.milesight.com/support/download/firmware
ADP enrichment
No English description supplied.
No references supplied.