CVE-2026-32649: Milesight Camera RCE Vulnerability

CVE-2026-32649 Overview

A command injection vulnerability has been identified in the web server component of specific firmware versions of Milesight cameras. This vulnerability, classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), allows attackers to inject and execute arbitrary operating system commands through the camera's web interface.

Command injection vulnerabilities in IoT devices such as IP cameras pose significant risks to enterprise security, as these devices often operate within internal networks with access to sensitive infrastructure. Successful exploitation could allow attackers to compromise the camera device, pivot to other network resources, or establish persistent access within the target environment.

Critical Impact

Remote attackers with network access can inject malicious commands through the Milesight camera web server, potentially leading to complete device compromise, unauthorized surveillance access, and lateral movement within the network.

Affected Products

• Milesight Cameras (specific firmware versions)
• Milesight Camera Web Server component

Discovery Timeline

• 2026-04-28 - CVE-2026-32649 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-32649

Vulnerability Analysis

This command injection vulnerability exists within the web server component of Milesight camera firmware. The flaw stems from improper neutralization of special elements used in operating system commands (CWE-78). When user-supplied input is passed to system command execution functions without adequate sanitization, attackers can inject additional commands that execute with the privileges of the web server process.

The vulnerability requires network access and high privileges, with some user interaction needed to exploit. However, once the conditions are met, successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected camera system.

IoT devices like IP cameras are particularly attractive targets because they often run with elevated privileges, have limited security monitoring, and may provide access to sensitive video feeds or serve as pivot points for further network intrusion.

Root Cause

The root cause of CVE-2026-32649 is insufficient input validation and sanitization in the Milesight camera web server. The application fails to properly neutralize special characters and command metacharacters (such as ;, |, &, $(), and backticks) in user-supplied input before incorporating it into operating system commands. This allows attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with network access to the Milesight camera's web interface can craft malicious requests containing injected commands. The exploitation requires high-level privileges on the system and some user interaction, which provides some mitigation against opportunistic attacks. However, in environments where cameras are exposed to untrusted networks or where attackers have compromised administrative credentials, this vulnerability presents a serious risk.

The attack flow typically involves:

1. Identifying a vulnerable Milesight camera on the network
2. Accessing the web server interface with required privileges
3. Submitting crafted input containing command injection payloads
4. The malicious commands execute on the underlying operating system with web server privileges

Technical details regarding specific exploitation techniques can be found in the CISA ICS Advisory.

Detection Methods for CVE-2026-32649

Indicators of Compromise

• Unusual outbound network connections from Milesight camera devices to unknown external IP addresses
• Unexpected processes or services running on camera devices
• Anomalous HTTP requests to the camera web interface containing shell metacharacters (;, |, &, $(, backticks)
• Modified firmware or configuration files on affected cameras
• Authentication logs showing unexpected administrative access patterns

Detection Strategies

• Implement network traffic analysis to identify suspicious patterns in requests to camera web interfaces
• Deploy intrusion detection signatures for common command injection payloads targeting IoT devices
• Monitor camera devices for unexpected process execution or network behavior
• Review web server access logs for requests containing shell metacharacters or encoded command sequences

Monitoring Recommendations

• Enable and centralize logging for all Milesight camera devices in your environment
• Implement network segmentation monitoring to detect lateral movement attempts from IoT networks
• Configure alerts for administrative access to camera devices outside normal business hours
• Establish baseline behavior for camera network traffic and alert on deviations

How to Mitigate CVE-2026-32649

Immediate Actions Required

• Isolate affected Milesight cameras on a dedicated network segment with strict access controls
• Audit and restrict network access to camera web interfaces to only authorized administrators
• Review camera device logs for signs of compromise or exploitation attempts
• Apply firmware updates from Milesight as soon as they become available

Patch Information

Milesight has released firmware updates to address this vulnerability. Administrators should download and apply the latest firmware from the Milesight Firmware Download page. Before applying updates, verify the firmware integrity and follow Milesight's recommended update procedures.

For additional technical details and remediation guidance, refer to the CISA ICS Advisory ICSA-26-113-03 and the GitHub CSAF Document.

Workarounds

• Restrict web interface access using firewall rules to limit connections to trusted IP addresses only
• Place cameras behind a VPN to prevent direct internet exposure
• Disable any unnecessary web interface features until patches can be applied
• Implement strong authentication and ensure administrative credentials are not shared or easily guessable
• Consider deploying a web application firewall (WAF) capable of filtering command injection patterns

# Example: Firewall rule to restrict camera web interface access
# Allow only specific management IP addresses
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP