CVE-2026-32644: Milesight AIOT Cameras: SSL Certificates with Default Private Keys
CVE-2026-32644 affects specific firmware versions of Milesight AIOT cameras, which use SSL certificates whose private keys are default values. CISA's ICS-CERT, the CNA, rates the issue critical with a CVSS 3.1 score of 9.8. The record does not list affected or fixed versions, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-32644 describes a cryptographic weakness in specific firmware versions of Milesight AIOT cameras. The certificates used for SSL/TLS are associated with private keys that are default values rather than keys unique to each device. The weakness is classified as CWE-321 (use of hard-coded cryptographic key).
Impact
- Confirmed by the record: the CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the CVSS 4.0 score is 9.2, both provided by ICS-CERT.
- Inference: a private key that is the same across devices and known to others cannot protect the confidentiality of TLS sessions, and it may allow a network-positioned party to impersonate a device or intercept traffic.
- Unknown: the record does not describe the specific consequences in deployed environments.
Affected Products and Versions
The record states that specific firmware versions of Milesight AIOT cameras are affected, but it does not list product models, affected version ranges or fixed versions. Consult the CISA advisory and the vendor download page for authoritative details.
Exploitation Status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted, and this analysis does not claim active exploitation.
Remediation and Mitigation
- Check the CISA advisory ICSA-26-113-03 and the machine-readable CSAF file for vendor guidance.
- Review the Milesight firmware downloads page for updated firmware for affected camera models.
- Until a verified fix is applied, restrict network access to camera management and video interfaces, and keep them out of untrusted networks.
- Plan certificate and key replacement with unique, device-generated keys if the vendor provides that option.
Detection Guidance
- Build an inventory of Milesight AIOT cameras, including model and firmware version, and compare it against the vendor and CISA guidance.
- Review which cameras present certificates that the vendor identifies as using default keys, using only authorized tooling and approved procedures.
- Monitor for unexpected changes in certificates or TLS endpoints on camera networks.
Limitations of the Available Information
The record has no product model list, no affected or fixed version ranges, and no vendor patch details. The EPSS probability is 0.00387 (percentile 0.30855). Analysts should verify details against the CISA advisory and the vendor before making decisions.
Frequently asked questions
What is the core problem in CVE-2026-32644?
Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys, so the keys are not unique to each device.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and is there a fix?
The record does not list affected or fixed versions. Check the CISA advisory and the Milesight firmware downloads page for vendor details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.