Loading story…
CISA added two high-severity vulnerabilities affecting specific Milesight AIOT camera firmware versions, exposing the devices through embedded secrets in the product. CVE-2026-27785 is a hard-coded credentials flaw (CWE-798) that can allow unauthorized access without privileges or user interaction, with impact spanning confidentiality, integrity, and availability. The issue was listed with a CVSS v3.1 vector of AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating attackers on an adjacent network could exploit the weakness to take control of affected cameras.
CISA also published CVE-2026-32644, a hard-coded cryptographic key issue (CWE-321) tied to SSL certificates that use default private keys in Milesight camera firmware. That flaw carries a critical CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it is remotely exploitable over the network and could enable full compromise of device communications and operations. The disclosures were accompanied by CISA advisory and CSAF references, as well as vendor firmware download links for affected Milesight products.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ICS-CERT newly received CVE-2026-32644 on 2026-04-28 affecting specific Milesight AIOT camera firmware versions. The vulnerability involves SSL certificates using default private keys, classified as CWE-321, and is rated critical for confidentiality, integrity, and availability impact.
ICS-CERT newly received CVE-2026-27785 on 2026-04-28 for specific Milesight AIOT camera firmware versions. The flaw is a CWE-798 hard-coded credentials issue with high impact to confidentiality, integrity, and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published an ICS advisory for **CVE-2026-40624**, a critical flaw affecting multiple AVer PTC camera models, including the **PTC500S, PTC115, PTC500+, and PTC115+**. The vulnerability stems from improper input validation and can allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request. The issue is rated **Critical**, with a **CVSS v3.1 score of 9.8** and a **CVSS v4.0 score of 9.3**, and all listed versions of the affected products were reported as vulnerable. CISA said it had no reports of public exploitation targeting the flaw at the time of publication, but urged organizations to reduce internet exposure of control system devices, isolate affected networks, and use secure remote access methods such as fully updated VPNs. Additional mitigation guidance calls for updating camera firmware to the latest available version and applying vendor-provided security patches as they become available.
Jul 12, 2026
Yi Technology's **YI Home Camera 2** firmware `2.1.1_20171024151200` was found to contain two high-severity vulnerabilities in `home/web/ipc`, including **hard-coded credentials** tracked as `CVE-2026-4475` and **improper cryptographic signature verification** in the HTTP firmware update handler tracked as `CVE-2026-4478`. The hard-coded credentials issue could allow an attacker with local network access to compromise the device, while the firmware update flaw could enable remote abuse of the update mechanism despite higher attack complexity. Both issues were publicly disclosed with reports indicating exploit details are available, increasing the risk of real-world abuse against affected cameras. The vulnerabilities are classified under **CWE-798/CWE-259** for embedded credentials and **CWE-345/CWE-347** for signature verification failures, and the vendor reportedly did not respond after being contacted before disclosure.
Jun 29, 2026
A critical vulnerability in KMW CCTV cameras, tracked as **CVE-2026-5386**, allows unauthenticated remote attackers to reset administrator passwords and seize control of affected devices. The flaw, described as an improper password-change verification weakness and rated **CVSS 9.1**, affects the **KM-IP521** and **KM-IP421** models, including firmware versions `IPCAM_V4.04.91.230307` and `IPCAM_V4.04.53.210416`. Successful exploitation can expose live video feeds, change device settings, disable surveillance functions, and alter logs to hide malicious activity. KMW has released patched firmware for the affected cameras, although the update for the **KM-IP421** temporarily removes cloud authorization functionality. CISA identified the issue in advisory **ICSA-26-148-06** and urged organizations to treat internet-exposed cameras as a high-priority risk, particularly in sectors including government, finance, transportation, manufacturing, and commercial facilities. No active exploitation has been confirmed, but defenders were advised to apply firmware updates immediately, keep surveillance devices off the public internet, isolate them behind firewalls or segmented networks, and limit remote access to secure VPN connections.
Jun 29, 2026