Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-28 | 2 | Disclosure1General1 |
| 2026-04-29 | 1 | Disclosure1 |
Milesight Cameras , CVE-2026-27785 , CVE-2026-32644 -- https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03
Post summary
The post lists two CVEs for Milesight cameras and links to a CISA advisory, but offers no further detail on the vulnerability, exploitation, or mitigation.
🚨 Critical CVEs Today: IoT & Cloud Stack (CVSS 9.8-9.8) Affected: Milesight AIOT; NVIDIA NVFlare Dashboard; Totolink A8000RU CGI Handler Internet-facing risks dominate, led by IoT devices and cloud platforms; fixes and mitigations below. • CVE-2026-32644 (CVSS 9.8) Milesight AIOT cameras with affected firmware versions use SSL certificates with default private keys. • CVE-2026-24178 (CVSS 9.8) NVIDIA NVFlare Dashboard (unspecified versions) contains unauthenticated authorization bypass via a user-controlled key. • CVE-2026-7202 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setWiFiWpsStart allows remote OS command injection via wscDisabled. • CVE-2026-7203 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setUrlFilterRules allows remote OS command injection via enable parameter. • CVE-2026-7204 (CVSS 9.8) Totolink A8000RU 7.1cu.643_b20200521 CGI Handler setPptpServerCfg allows remote OS command injection via enable parameter. 🛠️ Action • Patch/upgrade to the fixed versions called out (or vendor advisory latest) • Prioritize internet-facing instances and edge appliances first • If "no fix yet", apply the stated mitigations and reduce exposure (disable feature/module, restrict access) • Add detections for the exploitation patterns implied by the CVEs (process spawning, webshell/file-write paths, auth anomalies) • Hunt for indicators around the affected services during the disclosure-to-now window (logs, EDR, WAF) • Validate remediation (version checks, config verification) and monitor for reversion
Post summary
This post discloses several critical CVEs impacting IoT devices and a cloud dashboard, detailing CVSS scores, affected firmware, and the nature of each vulnerability, and it offers patching and mitigation guidance.
⚡ New CVE Alert: CVE-2026-32644 📊 Severity: 9.8 🚨 Risk Level: Critical 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32644 #CVE-2026-32644 #CVE #Critical #CyberSecurity #InfoSec https://t.co/j4ILsmwo1x
Post summary
The post announces a newly identified CVE‑2026‑32644 with a high severity of 9.8 affecting multiple unspecified products, but offers no exploit detail, patches, or evidence of active use.