CVE-2026-27785: Hardcoded Credentials in Milesight AIOT Cameras

The presence of hardcoded credentials allows an attacker to gain unauthorized access to the camera system. This can lead to a wide range of malicious activities, including viewing live camera feeds, accessing recorded footage, modifying camera settings, and potentially using the camera as a pivot point to compromise other devices on the network. The impact is particularly severe given the increasing use of AIOT cameras in sensitive environments. The blast radius extends to any systems accessible from the compromised camera.

1. Veröffentlicht2026-04-27
2. Geändert2026-04-28
3. EPSS aktualisiert2026-05-05

The primary mitigation is to update the Milesight MS-Cxx63-PD AIOT camera firmware to the latest available version. Check the Milesight website for firmware updates and release notes. If updating is not immediately possible, consider isolating the camera from the network to prevent unauthorized access. Change any default passwords immediately. Monitor network traffic for suspicious activity originating from the camera. After updating, verify the fix by attempting to access the camera's administrative interface using the default credentials; access should be denied.