A command injection flaw exists in the web server of specific Milesight camera firmware versions, allowing an attacker to inject and execute arbitrary operating‑system commands on the affected device. The vulnerability is classified as CWE‑78, and its exploitation could grant full remote control of the camera, potentially leading to data modification, device reset, or denial of service. The CVSS score of 7.3 indicates a high severity level, underscoring the seriousness of the flaw.

The flaw affects a broad range of Milesight camera models, including the MS‑C series such as MS‑C2964‑RFLPC, MS‑C2966‑RFLWPC, MS‑C2966‑X12RLPC, MS‑C2966‑X12RLVPC, MS‑C2972‑RFLPC, MS‑C5321‑FPE, MS‑C5361‑X12LPC, MS‑C5366‑X12LPC, and MS‑C5366‑X12LVPC. In addition, many TS, TS4x, TS5x, and TS8x models such as TS2866‑X4TPC, TS2867‑X5TPC, TS2961‑X12TPC, TS8266‑X4RIPG1, TS8266‑X4RIVPG1, TS8266‑X4RIWG1, and TS8266‑X4WE are listed as vulnerable. Firmware versions ranging from 45.8.0.3‑r10 up to 63.8.0.5‑r4 (and intermediate revisions) are reported as affected, with vendor–specific upgrade paths documented.

The CVSS score of 7.3 indicates high severity, while the EPSS score of <1% suggests that exploitation is currently limited. However, the flaw is likely to be exploited via a network‑based attack against the device’s web interface; an attacker can send a crafted HTTP request to trigger the command injection without needing prior authentication, especially if the device is exposed or has weak credentials. Given the widespread distribution of affected models and the straightforward nature of the exploit, the overall risk is considered moderate to high until mitigated.