PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28747 Milesight CVE debrief

CVE-2026-28747 affects specific Milesight AIOT camera firmware and involves weak key generation. CISA’s advisory points administrators to vendor firmware updates for the impacted models. Based on the supplied enrichment, it is not listed in CISA KEV, so this is best treated as a high-priority patching and asset-validation issue rather than a confirmed active-exploitation case.

Vendor
Milesight
Product
MS-Cxx63-PD
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-23
Original CVE updated
2026-04-23
Advisory published
2026-04-23
Advisory updated
2026-04-23

Who should care

Security teams, OT/physical security operators, system integrators, and asset owners responsible for Milesight camera deployments should review this advisory, especially if they manage the listed firmware branches or devices in sensitive environments.

Technical summary

The CISA CSAF advisory describes a weak key generation vulnerability in specific Milesight AIOT camera firmware. Weak key generation can undermine the strength of cryptographic protections used by the device. The advisory lists multiple affected product lines and corresponding fixed firmware releases, with Milesight directing users to install the latest firmware available from its support download portal.

Defensive priority

High priority for affected fleets. Identify exact models and firmware versions, apply the vendor-fixed firmware as soon as practical, and verify that deployed devices match the advisory’s affected scope.

Recommended defensive actions

  • Inventory Milesight camera models and firmware versions against the advisory’s affected product list.
  • Apply the vendor firmware updates listed in the CSAF remediation entries for each affected model.
  • Use Milesight’s official firmware download channel referenced in the advisory to obtain fixes.
  • Confirm remediation by rechecking firmware versions after upgrade.
  • Prioritize internet-reachable or operationally important camera deployments for faster remediation.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-26-113-03 for CVE-2026-28747, published and modified on 2026-04-23. The source states a weak key generation vulnerability in specific Milesight AIOT camera firmware and provides vendor remediation guidance. Supplied enrichment marks the issue as non-KEV and does not note ransomware campaign use. The vendor field in the prompt is low-confidence/raw and should be validated against the advisory and local asset inventory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28747 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28747

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28747 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28747

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-113-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.