Hard-coded Credentials in Milesight AIOT Camera Firmware

Successful exploitation could allow an unauthenticated attacker on an adjacent network to use the embedded credentials to gain unauthorized access to the affected camera environment or exposed management/service interfaces. The provided CVSS v3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact to confidentiality, integrity, and availability, suggesting the vulnerability may enable broad compromise of the affected device, including access to sensitive data, unauthorized configuration changes, and disruption of device operation.

Until patched firmware can be deployed, restrict access to affected cameras to trusted management networks only, eliminate adjacent-network exposure where possible, and segment camera networks from enterprise and internet-facing environments. Apply ACLs or firewall rules to limit access to administrative and service interfaces, disable unnecessary services, monitor for unauthorized authentication attempts, and inventory affected Milesight AIOT devices to prioritize remediation. If the hard-coded account can be disabled or its reachable interface can be turned off without operational impact, do so as an interim measure.

Upgrade affected Milesight AIOT camera firmware to a fixed version provided by the vendor. The provided content references Milesight firmware downloads and the CISA ICS advisory ICSA-26-113-03; those sources should be used to identify the specific affected and remediated firmware versions. If supported by the vendor, rotate or disable any exposed default or embedded credentials after upgrading.