# Critical Flaws in Milesight IP Cameras Allow Remote Code Execution Across Multiple Product Lines
Milesight has disclosed five critical vulnerabilities affecting dozens of camera models across its product lineup, with successful exploitation potentially leading to remote code execution or device denial of service. The affected firmware versions span multiple camera families, leaving a broad installed base at risk.
## The Threat
A coordinated vulnerability disclosure reveals critical flaws in Milesight's IP camera firmware that could allow attackers to gain unauthorized access and execute arbitrary code on vulnerable devices. These five distinct CVEs—CVE-2026-28747, CVE-2026-27785, CVE-2026-32644, CVE-2026-32649, and CVE-2026-20766—collectively impact surveillance systems deployed across enterprises, integrators, and managed security service providers.
The vulnerabilities appear to stem from improper input validation and authentication bypass flaws in the camera firmware. Attackers exploiting these issues could remotely crash affected cameras, disrupting surveillance operations, or worse—gain persistent access to devices that typically sit on the same network segment as critical infrastructure, security systems, and sensitive workstations. In a security camera network, compromised devices can become a beachhead for lateral movement and further network exploitation.
The widespread nature of the vulnerability is particularly concerning. Rather than affecting a single product line, the flaws impact Milesight's most commonly deployed models—the Cx-series compact cameras, N-series network cameras, PMC8266 series, and enterprise-grade options. Organizations using these cameras for perimeter security, access control documentation, or facility monitoring face immediate risk.
## Severity and Impact
| CVE ID | CVSS Score | Attack Vector | Attack Complexity | Authentication | Primary Impact |
|--------|------------|----------------|-------------------|-----------------|-----------------|
| CVE-2026-28747 | Critical | Network | Low | None Required | Remote Code Execution |
| CVE-2026-27785 | Critical | Network | Low | None Required | Remote Code Execution |
| CVE-2026-32644 | High | Network | Low | None Required | Denial of Service |
| CVE-2026-32649 | High | Network | Low | None Required | Denial of Service |
| CVE-2026-20766 | High | Network | Low | None Required | Denial of Service |
All five vulnerabilities require network access but do not require authentication, making them exploitable from the internet if cameras are directly exposed or accessible through compromised network boundaries.
## Affected Products
### Compact Dome Series (51.7.0.77-r12 and earlier)
### Pan-Tilt Models
### High-Performance Turret Series (63.8.0.5-r3 and earlier)
### Box Camera Series (61.8.0.5-r2 and earlier)
### Specialist Models
### Network Camera Series (7x.9.0.19-r5 and earlier)
### Enterprise Panoramic Models (CQ_63.8.0.5-r1 and earlier)
### Third-Party OEM Variants
This list encompasses entry-level surveillance systems through enterprise-grade panoramic and thermal models, reflecting the pervasiveness of the vulnerability across Milesight's portfolio.
## Mitigations
Immediate Actions
Organizations should treat camera firmware updates as a critical priority. Milesight has released patched firmware versions for all affected models. Administrators should:
1. Inventory all Milesight cameras in your environment and document current firmware versions. Use your VMS (Video Management System) to automate this if available.
2. Prioritize internet-facing cameras for immediate patching. If any cameras are accessible from the public internet or through port forwarding, consider temporarily isolating them from the network until patches are applied.
3. Apply firmware updates through the camera's web interface or management console. Test patches in a non-production environment first to verify compatibility with your recording and alerting workflows.
4. Change default credentials on all cameras if you haven't already. Many Milesight models ship with weak default passwords that increase exploitation risk.
Network Segmentation
Detection and Monitoring
Long-Term Hardening
## References
---
Bottom Line: These are not theoretical vulnerabilities—they affect dozens of camera models likely deployed in your organization. If your security architecture relies on Milesight cameras, firmware updates should be treated as a critical security incident response activity, not a routine maintenance task. Unpatched cameras represent a direct path for attackers to access your surveillance infrastructure and the networks it monitors.