# cve.now: Milesight

The newest entries naming Milesight as an affected vendor (up to 200), of 94 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-29988](https://cve.now/CVE-2026-29988.md): A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecte (CVSS 8.3)
- [CVE-2026-20766](https://cve.now/CVE-2026-20766.md): Milesight Cameras Heap-based Buffer Overflow (CVSS 8.6)
- [CVE-2026-32649](https://cve.now/CVE-2026-32649.md): Milesight Cameras OS Command Injection (CVSS 7.3)
- [CVE-2026-32644](https://cve.now/CVE-2026-32644.md): Milesight Cameras Use of Hard-coded Cryptographic Key (CVSS 9.2)
- [CVE-2026-27785](https://cve.now/CVE-2026-27785.md): Milesight Cameras Use of Hard-coded Credentials (CVSS 7.7)
- [CVE-2026-28747](https://cve.now/CVE-2026-28747.md): Milesight Cameras Authorization Bypass Through User-Controlled Key (CVSS 7.3)
- [CVE-2025-4043](https://cve.now/CVE-2025-4043.md): Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code (CVSS 6.8)
- [CVE-2024-36392](https://cve.now/CVE-2024-36392.md): MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 6.1)
- [CVE-2024-36391](https://cve.now/CVE-2024-36391.md): MileSight DeviceHub - CWE-320: Key Management Errors (CVSS 9.1)
- [CVE-2024-36390](https://cve.now/CVE-2024-36390.md): MileSight DeviceHub - CWE-20 Improper Input Validation (CVSS 7.5)
- [CVE-2024-36389](https://cve.now/CVE-2024-36389.md): MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values (CVSS 9.8)
- [CVE-2024-36388](https://cve.now/CVE-2024-36388.md): MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function (CVSS 10.0)
- [CVE-2024-27776](https://cve.now/CVE-2024-27776.md): MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 9.8)
- [CVE-2023-47166](https://cve.now/CVE-2023-47166.md): A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. (CVSS 8.8)
- [CVE-2023-23550](https://cve.now/CVE-2023-23550.md): An OS command injection vulnerability exists in the ys\_thirdparty user\_delete functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-23547](https://cve.now/CVE-2023-23547.md): A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. (CVSS 6.5)
- [CVE-2023-23571](https://cve.now/CVE-2023-23571.md): An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. (CVSS 7.5)
- [CVE-2023-23902](https://cve.now/CVE-2023-23902.md): A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. (CVSS 9.8)
- [CVE-2023-22306](https://cve.now/CVE-2023-22306.md): An OS command injection vulnerability exists in the libzebra.so bridge\_group functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-22659](https://cve.now/CVE-2023-22659.md): An os command injection vulnerability exists in the libzebra.so change\_hostname functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-22844](https://cve.now/CVE-2023-22844.md): An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. (CVSS 7.3)
- [CVE-2023-22319](https://cve.now/CVE-2023-22319.md): A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. (CVSS 7.3)
- [CVE-2023-23907](https://cve.now/CVE-2023-23907.md): A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. (CVSS 7.5)
- [CVE-2023-22371](https://cve.now/CVE-2023-22371.md): An os command injection vulnerability exists in the liburvpn.so create\_private\_key functionality of Milesight VPN v2.0.2. (CVSS 8.1)
- [CVE-2023-24497](https://cve.now/CVE-2023-24497.md): Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail\_device functionality of Milesight VPN v2.0.2. (CVSS 4.7)
- [CVE-2023-24496](https://cve.now/CVE-2023-24496.md): Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail\_device functionality of Milesight VPN v2.0.2. (CVSS 4.7)
- [CVE-2023-23546](https://cve.now/CVE-2023-23546.md): A misconfiguration vulnerability exists in the urvpn\_client functionality of Milesight UR32L v32.3.0.5. (CVSS 4.2)
- [CVE-2023-24520](https://cve.now/CVE-2023-24520.md): Two OS command injection vulnerability exist in the vtysh\_ubus toolsh\_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-24519](https://cve.now/CVE-2023-24519.md): Two OS command injection vulnerability exist in the vtysh\_ubus toolsh\_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-24583](https://cve.now/CVE-2023-24583.md): Two OS command injection vulnerabilities exist in the urvpn\_client cmd\_name\_action functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-24582](https://cve.now/CVE-2023-24582.md): Two OS command injection vulnerabilities exist in the urvpn\_client cmd\_name\_action functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-22365](https://cve.now/CVE-2023-22365.md): An OS command injection vulnerability exists in the ys\_thirdparty check\_system\_user functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-22299](https://cve.now/CVE-2023-22299.md): An OS command injection vulnerability exists in the vtysh\_ubus \_get\_fw\_logs functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-24595](https://cve.now/CVE-2023-24595.md): An OS command injection vulnerability exists in the ys\_thirdparty system\_user\_script functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-22653](https://cve.now/CVE-2023-22653.md): An OS command injection vulnerability exists in the vtysh\_ubus tcpdump\_start\_cb functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8)
- [CVE-2023-24018](https://cve.now/CVE-2023-24018.md): A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security\_decrypt\_password functionality of Milesight UR32L v32.3 (CVSS 8.8)
- [CVE-2023-25124](https://cve.now/CVE-2023-25124.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25123](https://cve.now/CVE-2023-25123.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25122](https://cve.now/CVE-2023-25122.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25121](https://cve.now/CVE-2023-25121.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25120](https://cve.now/CVE-2023-25120.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25119](https://cve.now/CVE-2023-25119.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25118](https://cve.now/CVE-2023-25118.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25117](https://cve.now/CVE-2023-25117.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25116](https://cve.now/CVE-2023-25116.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25115](https://cve.now/CVE-2023-25115.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25114](https://cve.now/CVE-2023-25114.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25113](https://cve.now/CVE-2023-25113.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25112](https://cve.now/CVE-2023-25112.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25111](https://cve.now/CVE-2023-25111.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25110](https://cve.now/CVE-2023-25110.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25109](https://cve.now/CVE-2023-25109.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25108](https://cve.now/CVE-2023-25108.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25107](https://cve.now/CVE-2023-25107.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25106](https://cve.now/CVE-2023-25106.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25105](https://cve.now/CVE-2023-25105.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25104](https://cve.now/CVE-2023-25104.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25103](https://cve.now/CVE-2023-25103.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25102](https://cve.now/CVE-2023-25102.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25101](https://cve.now/CVE-2023-25101.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25100](https://cve.now/CVE-2023-25100.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25099](https://cve.now/CVE-2023-25099.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25098](https://cve.now/CVE-2023-25098.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25097](https://cve.now/CVE-2023-25097.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25096](https://cve.now/CVE-2023-25096.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25095](https://cve.now/CVE-2023-25095.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25094](https://cve.now/CVE-2023-25094.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25093](https://cve.now/CVE-2023-25093.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25092](https://cve.now/CVE-2023-25092.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25091](https://cve.now/CVE-2023-25091.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25090](https://cve.now/CVE-2023-25090.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25089](https://cve.now/CVE-2023-25089.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25088](https://cve.now/CVE-2023-25088.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25087](https://cve.now/CVE-2023-25087.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25086](https://cve.now/CVE-2023-25086.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25085](https://cve.now/CVE-2023-25085.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25084](https://cve.now/CVE-2023-25084.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25083](https://cve.now/CVE-2023-25083.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25082](https://cve.now/CVE-2023-25082.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-25081](https://cve.now/CVE-2023-25081.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2)
- [CVE-2023-24019](https://cve.now/CVE-2023-24019.md): A stack-based buffer overflow vulnerability exists in the urvpn\_client http\_connection\_readcb functionality of Milesight UR32L v32.3.0.5. (CVSS 8.1)
- [CVE-2023-25583](https://cve.now/CVE-2023-25583.md): Two OS command injection vulnerabilities exist in the zebra vlan\_name functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-25582](https://cve.now/CVE-2023-25582.md): Two OS command injection vulnerabilities exist in the zebra vlan\_name functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2)
- [CVE-2023-32220](https://cve.now/CVE-2023-32220.md): Milesight NCR/Camera Authentication Bypass (CVSS 8.2)
- [CVE-2023-24506](https://cve.now/CVE-2023-24506.md): Milesight NCR/Camera CWE-522: Insufficiently Protected Credentials (CVSS 7.5)
- [CVE-2023-24505](https://cve.now/CVE-2023-24505.md): Milesight NCR/Camera CWE-200: Exposure of Sensitive Information (CVSS 5.3)
- [CVE-2023-30467](https://cve.now/CVE-2023-30467.md): Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR) (CVSS 7.5)
- [CVE-2023-30466](https://cve.now/CVE-2023-30466.md): Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR) (CVSS 9.8)
- [CVE-2022-3001](https://cve.now/CVE-2022-3001.md): Vulnerability in Milesight Video Management Systems (VMS) (CVSS 7.5)
- [CVE-2016-2357](https://cve.now/CVE-2016-2357.md): Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory. (no CVSS)
- [CVE-2016-2356](https://cve.now/CVE-2016-2356.md): Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. (no CVSS)
- [CVE-2016-2359](https://cve.now/CVE-2016-2359.md): Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultan (no CVSS)
- [CVE-2016-2358](https://cve.now/CVE-2016-2358.md): Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. (no CVSS)
- [CVE-2016-2360](https://cve.now/CVE-2016-2360.md): Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' in (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/milesight
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.