PT-2026-35570 · Milesight · Milesight Cameras

Souvik Kandar · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-32649

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Milesight cameras (affected versions not specified)

Description A command injection flaw exists in the web server of the camera firmware. Command injection is a type of attack where an attacker can execute arbitrary operating system commands on the server by exploiting an application that improperly validates input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-32649

Affected Products

Milesight Cameras

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-32649 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.json · Note
• https://twitter.com/CVEarity/status/2049071811703488631 · Twitter Post
• https://t.me/CVEtracker/52023 · Telegram Post
• https://milesight.com/support/download/firmware · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-113-03 · Note
• https://t.me/cveNotify/161183 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049042363767455854 · Twitter Post