Milesight AIOT Cameras Critical Vulnerability: Default SSL Keys Exposed

The National Vulnerability Database has issued a critical advisory, CVE-2026-32644, for specific firmware versions of Milesight AIOT cameras. This vulnerability, carrying a CVSS score of 9.8 (CRITICAL), stems from the use of hardcoded, default private keys in the SSL certificates embedded within these devices. This isn’t just poor practice; it’s an open door for sophisticated adversaries.

Using default private keys completely undermines the security provided by SSL/TLS. An attacker with knowledge of these default keys can decrypt intercepted communications, impersonate the camera, or even inject malicious data. The impact is a full compromise of confidentiality, integrity, and availability, making these devices trivial to exploit for anyone with basic reconnaissance capabilities. This is CWE-321, a classic cryptographic weakness that should never make it into production.

For defenders, this means any Milesight AIOT cameras running affected firmware are effectively broadcasting their private keys. Attackers don’t need to brute-force or exploit complex logic; they just need to know the default key. This vulnerability drastically lowers the bar for compromise, turning these cameras into high-value targets for initial access, surveillance, or pivot points within a network.