CVE-2026-28747: Milesight AIOT Camera Auth Bypass Flaw

CVE-2026-28747 Overview

A weak key generation vulnerability has been identified in specific firmware versions of Milesight AIOT cameras. This security flaw allows attackers to bypass authorization controls, potentially gaining unauthorized access to camera systems and their associated functionality. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the weakness stems from improper handling of authorization mechanisms during key generation processes.

Critical Impact
Attackers on an adjacent network can potentially bypass authentication mechanisms on vulnerable Milesight AIOT cameras, leading to unauthorized access to video feeds, camera controls, and connected IoT infrastructure.

Affected Products

Milesight AIOT Camera Firmware (specific vulnerable versions)
Milesight IoT Camera Systems

Discovery Timeline

2026-04-27 - CVE-2026-28747 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-28747

Vulnerability Analysis

This vulnerability affects the key generation mechanism within Milesight AIOT camera firmware. The weakness allows authorization controls to be circumvented due to predictable or insufficiently random key generation. When cryptographic keys used for authorization are generated using weak algorithms or predictable seeds, attackers can potentially derive or guess valid keys, thereby bypassing security controls entirely.

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the vulnerable camera. While this limits remote exploitation scenarios, it remains a significant concern in enterprise environments, industrial facilities, or any location where AIOT cameras are deployed on shared network infrastructure.

The impact of successful exploitation includes complete compromise of confidentiality, integrity, and availability of the affected camera system. Attackers could view live video feeds, manipulate camera settings, disable recording functionality, or use compromised cameras as pivot points for further network intrusion.

Root Cause

The vulnerability stems from CWE-639: Authorization Bypass Through User-Controlled Key. The firmware uses a weak key generation algorithm that produces cryptographic keys with insufficient entropy or predictable patterns. This fundamental cryptographic weakness undermines the entire authorization framework, as attackers can derive valid authentication credentials without possessing legitimate access.

Attack Vector

The attack vector for CVE-2026-28747 requires adjacent network access (AV:A). An attacker positioned on the same network segment as the vulnerable Milesight AIOT camera can exploit the weak key generation to bypass authorization. The exploitation process involves:

Identifying vulnerable Milesight AIOT cameras on the local network
Analyzing or predicting the weak key generation output
Crafting authentication requests using derived or predicted keys
Bypassing authorization to gain unauthorized access to camera functions

Due to the adjacent network requirement, this vulnerability is particularly concerning in environments with flat network architectures where IoT devices share network segments with other systems.

Detection Methods for CVE-2026-28747

Indicators of Compromise

Unusual authentication attempts to camera management interfaces from unexpected internal IP addresses
Multiple successful authentication events without corresponding legitimate user activity
Anomalous access patterns to camera configuration or video streaming endpoints
Unexpected changes to camera settings or recording configurations

Detection Strategies

Monitor network traffic for authentication attempts to Milesight camera endpoints from non-administrative systems
Implement network segmentation monitoring to detect lateral movement toward IoT device subnets
Deploy IDS/IPS rules to identify authorization bypass patterns specific to camera management protocols
Review authentication logs for successful logins that bypass normal credential verification workflows

Monitoring Recommendations

Enable verbose logging on all Milesight AIOT cameras and forward logs to a centralized SIEM
Implement network behavior analytics to detect anomalous traffic patterns to IoT devices
Configure alerts for configuration changes on camera systems outside of maintenance windows
Monitor for unusual outbound connections from camera IP addresses that may indicate compromise

How to Mitigate CVE-2026-28747

Immediate Actions Required

Identify all Milesight AIOT cameras deployed in your environment and inventory firmware versions
Implement network segmentation to isolate IoT cameras from general network traffic
Apply strict access controls limiting which systems can communicate with camera management interfaces
Review access logs for any signs of unauthorized access or exploitation attempts

Patch Information

Milesight has released updated firmware to address this vulnerability. Organizations should download and apply the latest firmware from the Milesight Firmware Download page. Prior to deployment, verify firmware integrity and test updates in a non-production environment where possible.

Additional technical details and remediation guidance are available in the CISA ICS Advisory ICSA-26-113-03. CISA's CSAF data for this vulnerability can be found in the GitHub CSAF Resource.

Workarounds

Implement strict network segmentation placing all AIOT cameras on isolated VLANs with restricted access
Deploy firewall rules limiting camera management interface access to authorized administrative systems only
Use VPN or encrypted tunnels for remote camera administration rather than direct network access
Disable any unnecessary network services or protocols on camera devices to reduce attack surface

bash

# Example network segmentation configuration (firewall rules)
# Restrict access to camera management subnet (example: 10.10.50.0/24)
# Allow only authorized management station (example: 10.10.100.50)

iptables -A FORWARD -s 10.10.100.50 -d 10.10.50.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 10.10.100.50 -d 10.10.50.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.50.0/24 -j DROP