Milesight PM3322-E vulnerabilities

Latest Milesight PM3322-E CVEs

Newest publication first

1. CVE-2026-20766 Milesight Cameras Heap-based Buffer Overflow

   Published 2026-04-27

   High·CVSS 8.6 EPSS 0.29%

   An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.

2. CVE-2026-32649 Milesight Cameras OS Command Injection

   Published 2026-04-27

   High·CVSS 7.3 EPSS 0.86%

   A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.

3. CVE-2026-32644 Milesight Cameras Use of Hard-coded Cryptographic Key

   Published 2026-04-27

   Critical·CVSS 9.2 EPSS 0.22%

   Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.

4. CVE-2026-27785 Milesight Cameras Use of Hard-coded Credentials

   Published 2026-04-27

   High·CVSS 7.7 EPSS 0.22%

   Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.

5. CVE-2026-28747 Milesight Cameras Authorization Bypass Through User-Controlled Key

   Published 2026-04-27

   High·CVSS 7.3 EPSS 0.18%

   A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.