CVE-2026-28747CWE-639

Milesight Cameras Authorization Bypass Through User-Controlled Key

High · published April 27, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00277 · 19.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-27T22:44Z
EPSS history
Timeline
  • 27 APR 22:44Z
    Milesight Cameras Authorization Bypass Through User-Controlled Key
    cvelistv5