A weak key generation flaw is present in selected firmware builds of Milesight AIOT cameras. The vulnerability enables an attacker to supply a user‑controlled key that bypasses the device’s standard authorization checks, granting access without proper authentication. This flaw is identified as CWE‑639 and directly affects the cameras’ security controls.

The affected devices are Milesight AIOT cameras, including models such as MS‑C2964‑RFLPC, MS‑C2966‑RFLWPC, MS‑C2966‑X12RLPC, MS‑C2966‑X12RLVPC, MS‑C2972‑RFLPC, MS‑C5321‑FPE, MS‑C5361‑X12LPC, MS‑C5366‑X12LPC, MS‑C5366‑X12LVPC, MS‑C8477‑HPG1, MS‑C8477‑PC, and many others listed in the vendor’s catalog. The affected firmware versions are those released prior to the updates identified in Milesight’s advisory; for example, firmware updates such as 51.7.0.77‑r13 for the MS‑Cxx63‑PD family, 63.8.0.5‑r4 for the G1 series, and 45.8.0.3‑r10 for the RFLP and X4TPC models contain the fix.

The CVSS base score of 7.3 indicates a moderate‑to‑high risk to the confidentiality and integrity of the device. EPSS is reported as < 1 %, and the vulnerability is not listed in CISA KEV, suggesting no known widespread public exploitation yet. The likely attack vector is an attacker’s ability to influence key generation on an accessible camera—typically via local network access to the device’s management interface or remote access if the camera is exposed to the internet. Successful exploitation allows an attacker to bypass authorization checks, potentially accessing the camera without proper credentials.