Milesight Cameras Heap-based Buffer Overflow
Priority LOW 39CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Milesight | MS-Cxx63-PD | up to 51.7.0.77-r12 | — | No fix listed | CNA |
| Milesight | MS-Cxx64-xPD | up to 51.7.0.77-r12 | — | No fix listed | CNA |
| Milesight | MS-Cxx73-xPD | up to 51.7.0.77-r12 | — | No fix listed | CNA |
| Milesight | MS-Cxx75-xxPD | up to 51.7.0.77-r12 | — | No fix listed | CNA |
| Milesight | MS-Cxx83-xPD | up to 51.7.0.77-r12 | — | No fix listed | CNA |
| Milesight | MS-Cxx74-PA | up to 3x.8.0.3-r11 | — | No fix listed | CNA |
| Milesight | MS-C8477-HPG1 | up to 63.8.0.4-r3 | — | No fix listed | CNA |
| Milesight | MS-C8477-PC | up to 48.8.0.4-r3 | — | No fix listed | CNA |
| Milesight | MS-C5321-FPE | up to 62.8.0.4-r5 | — | No fix listed | CNA |
| Milesight | MS-Cxx72-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx62-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx52-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx66-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx66-xxxGPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx61-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx67-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx71-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx41-xxxPE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx76-PE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx65-PE | up to 61.8.0.5-r2 | — | No fix listed | CNA |
| Milesight | MS-Cxx66-xxxG1 | up to 63.8.0.5-r3 | — | No fix listed | CNA |
| Milesight | MS-Cxx62-xxxG1 | up to 63.8.0.5-r3 | — | No fix listed | CNA |
| Milesight | MS-Cxx72-xxxG1 | up to 63.8.0.5-r3 | — | No fix listed | CNA |
| Milesight | MS-CQxx31-xxxG1 | up to CQ_63.8.0.5-r1 | — | No fix listed | CNA |
| Milesight | MS-CQxx68-xxxG1 | up to CQ_63.8.0.5-r1 | — | No fix listed | CNA |
| Milesight | MS-CQxx72-xxxG1 | up to CQ_63.8.0.5-r1 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-NxE | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-xxC | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-xxE | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-xxG | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-xxH | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | MS-Nxxxx-xxT | up to 7x.9.0.19-r5 | — | No fix listed | CNA |
| Milesight | PMC8266-FPE | up to PO_61.8.0.4_LPR | — | No fix listed | CNA |
| Milesight | PMC8266-FGPE | up to PO_61.8.0.4_LPR | — | No fix listed | CNA |
| Milesight | PM3322-E | up to PI_61.8.0.3_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RIPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS5366-X12RIPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4RIPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RIVPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-RFIVPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4RIVPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-RFIVPG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RIWG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4RIWG1 | up to T_63.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS5510-GVH | up to T_47.8.0.4_LPR-r7 | — | No fix listed | CNA |
| Milesight | TS5510-GH | up to T_47.8.0.4_LPR-r6 | — | No fix listed | CNA |
| Milesight | TS5511-GVH | up to T_47.8.0.4_LPR-r6 | — | No fix listed | CNA |
| Milesight | TS2966-X12TPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS5366-X12PE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4PE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS2966-X12TVPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RVPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS5366-X12VPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4VPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4441-X36RPE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4441-X36RE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS4466-X4RWE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | TS8266-X4WE | up to T_61.8.0.4_LPR-r3 | — | No fix listed | CNA |
| Milesight | MS-C2964-RFLPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C2972-RFLPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C2966-RFLWPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2866-X4TPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2866-X4TVPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2866-X4TGPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2841-X36TPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2841-X36TPC/W | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2867-X5TPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS2961-X12TPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | TS8266-FPC/P | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C2966-X12RLPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C2966-X12RLVPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C5366-X12LPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C5366-X12LVPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-C5361-X12LPC | up to T_45.8.0.3-r9 | — | No fix listed | CNA |
| Milesight | MS-Cxx66-xxxxGOPC | up to 45.8.0.2-AIoT-r4 | — | No fix listed | CNA |
| Milesight | SC211 | up to C_21.1.0.8-r4 | — | No fix listed | CNA |
| Milesight | SP111 | up to 52.8.0.4-r5 | — | No fix listed | CNA |
| Milesight | MS-Cxx66-RFIPKG1 | up to 63.8.0.4-r1-NX | — | No fix listed | CNA |
| Milesight | MS-Cxx72-RFIPKG1 | up to 63.8.0.4-r1-NX | — | No fix listed | CNA |
| Milesight | MS-Cxx66-FIPKG1 | up to 63.8.0.4-r1-NX | — | No fix listed | CNA |
| Milesight | MS-Cxx72-FIPKG1 | up to 63.8.0.4-r1-NX | — | No fix listed | CNA |
- MS-Cxx63-PD VendorMilesight Affected up to 51.7.0.77-r12 Fixed in — No fix listed CNA
- MS-Cxx64-xPD VendorMilesight Affected up to 51.7.0.77-r12 Fixed in — No fix listed CNA
- MS-Cxx73-xPD VendorMilesight Affected up to 51.7.0.77-r12 Fixed in — No fix listed CNA
- MS-Cxx75-xxPD VendorMilesight Affected up to 51.7.0.77-r12 Fixed in — No fix listed CNA
- MS-Cxx83-xPD VendorMilesight Affected up to 51.7.0.77-r12 Fixed in — No fix listed CNA
- MS-Cxx74-PA VendorMilesight Affected up to 3x.8.0.3-r11 Fixed in — No fix listed CNA
- MS-C8477-HPG1 VendorMilesight Affected up to 63.8.0.4-r3 Fixed in — No fix listed CNA
- MS-C8477-PC VendorMilesight Affected up to 48.8.0.4-r3 Fixed in — No fix listed CNA
- MS-C5321-FPE VendorMilesight Affected up to 62.8.0.4-r5 Fixed in — No fix listed CNA
- MS-Cxx72-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx62-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx52-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx66-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx66-xxxGPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx61-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx67-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx71-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx41-xxxPE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx76-PE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx65-PE VendorMilesight Affected up to 61.8.0.5-r2 Fixed in — No fix listed CNA
- MS-Cxx66-xxxG1 VendorMilesight Affected up to 63.8.0.5-r3 Fixed in — No fix listed CNA
- MS-Cxx62-xxxG1 VendorMilesight Affected up to 63.8.0.5-r3 Fixed in — No fix listed CNA
- MS-Cxx72-xxxG1 VendorMilesight Affected up to 63.8.0.5-r3 Fixed in — No fix listed CNA
- MS-CQxx31-xxxG1 VendorMilesight Affected up to CQ_63.8.0.5-r1 Fixed in — No fix listed CNA
- MS-CQxx68-xxxG1 VendorMilesight Affected up to CQ_63.8.0.5-r1 Fixed in — No fix listed CNA
- MS-CQxx72-xxxG1 VendorMilesight Affected up to CQ_63.8.0.5-r1 Fixed in — No fix listed CNA
- MS-Nxxxx-NxE VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- MS-Nxxxx-xxC VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- MS-Nxxxx-xxE VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- MS-Nxxxx-xxG VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- MS-Nxxxx-xxH VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- MS-Nxxxx-xxT VendorMilesight Affected up to 7x.9.0.19-r5 Fixed in — No fix listed CNA
- PMC8266-FPE VendorMilesight Affected up to PO_61.8.0.4_LPR Fixed in — No fix listed CNA
- PMC8266-FGPE VendorMilesight Affected up to PO_61.8.0.4_LPR Fixed in — No fix listed CNA
- PM3322-E VendorMilesight Affected up to PI_61.8.0.3_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RIPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS5366-X12RIPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4RIPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RIVPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-RFIVPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4RIVPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-RFIVPG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RIWG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4RIWG1 VendorMilesight Affected up to T_63.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS5510-GVH VendorMilesight Affected up to T_47.8.0.4_LPR-r7 Fixed in — No fix listed CNA
- TS5510-GH VendorMilesight Affected up to T_47.8.0.4_LPR-r6 Fixed in — No fix listed CNA
- TS5511-GVH VendorMilesight Affected up to T_47.8.0.4_LPR-r6 Fixed in — No fix listed CNA
- TS2966-X12TPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS5366-X12PE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4PE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS2966-X12TVPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RVPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS5366-X12VPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4VPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4441-X36RPE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4441-X36RE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS4466-X4RWE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- TS8266-X4WE VendorMilesight Affected up to T_61.8.0.4_LPR-r3 Fixed in — No fix listed CNA
- MS-C2964-RFLPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C2972-RFLPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C2966-RFLWPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2866-X4TPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2866-X4TVPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2866-X4TGPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2841-X36TPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2841-X36TPC/W VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2867-X5TPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS2961-X12TPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- TS8266-FPC/P VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C2966-X12RLPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C2966-X12RLVPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C5366-X12LPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C5366-X12LVPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-C5361-X12LPC VendorMilesight Affected up to T_45.8.0.3-r9 Fixed in — No fix listed CNA
- MS-Cxx66-xxxxGOPC VendorMilesight Affected up to 45.8.0.2-AIoT-r4 Fixed in — No fix listed CNA
- SC211 VendorMilesight Affected up to C_21.1.0.8-r4 Fixed in — No fix listed CNA
- SP111 VendorMilesight Affected up to 52.8.0.4-r5 Fixed in — No fix listed CNA
- MS-Cxx66-RFIPKG1 VendorMilesight Affected up to 63.8.0.4-r1-NX Fixed in — No fix listed CNA
- MS-Cxx72-RFIPKG1 VendorMilesight Affected up to 63.8.0.4-r1-NX Fixed in — No fix listed CNA
- MS-Cxx66-FIPKG1 VendorMilesight Affected up to 63.8.0.4-r1-NX Fixed in — No fix listed CNA
- MS-Cxx72-FIPKG1 VendorMilesight Affected up to 63.8.0.4-r1-NX Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-20766
- 2026-10-03 Alias added: GHSA-7x7c-x6r8-32h9
References
More Milesight vulnerabilities
- TI-2023-09701 Stack-based buffer overflow in Milesight UR32L CVSS 3.1CRITICAL 9.8
- TI-2023-08998 An authentication bypass vulnerability exists in the requestHandlers.js verifyToken… CVSS 3.1CRITICAL 9.8
- TI-2023-08584 SQL injection in MilesightVPN CVSS 3.1CRITICAL 9.8
- TI-2023-23160 An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7… CVSS 3.1HIGH 7.5
- TI-2023-10201 Command injection in Milesight UR32L CVSS 3.1HIGH 8.8
- TI-2023-10200 Command injection in Milesight UR32L CVSS 3.1HIGH 8.8
Sources
- CVE-2026-20766 · CVE Program
- CVE-2026-20766 · NVD
- FIRST EPSS
- GHSA-7x7c-x6r8-32h9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences