Milesight vulnerabilities
94 CVEs and advisories name Milesight as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-29988A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecte
- CVE-2026-20766Milesight Cameras Heap-based Buffer Overflow
- CVE-2026-32649Milesight Cameras OS Command Injection
- CVE-2026-32644Milesight Cameras Use of Hard-coded Cryptographic Key
- CVE-2026-27785Milesight Cameras Use of Hard-coded Credentials
- CVE-2026-28747Milesight Cameras Authorization Bypass Through User-Controlled Key
- CVE-2025-4043Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
- CVE-2024-36392MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2024-36391MileSight DeviceHub - CWE-320: Key Management Errors
- CVE-2024-36390MileSight DeviceHub - CWE-20 Improper Input Validation
- CVE-2024-36389MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values
- CVE-2024-36388MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function
- CVE-2024-27776MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CVE-2023-47166A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2.
- CVE-2023-23550An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-23547A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-23571An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-23902A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-22306An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-22659An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-22844An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2.
- CVE-2023-22319A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2.
- CVE-2023-23907A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2.
- CVE-2023-22371An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2.
- CVE-2023-24497Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2.
- CVE-2023-24496Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2.
- CVE-2023-23546A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-24520Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-24519Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5.
- CVE-2023-24583Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5.