5.3
Medium
CVE-2025-0836 Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management…
Description
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| XProtect VMS 25.1 | 25.1 → < 25.1.15990.2272 | 25.1.15990.2272 |
| XProtect VMS 24.2 | 24.2 → < 24.2.14561.2270 | 24.2.14561.2270 |
| XProtect VMS 24.1 | 24.1 → < 24.1.12292.2279 | 24.1.12292.2279 |
| XProtect VMS 23.3 | 23.3 → < 23.3.72.1.466 | 23.3.72.1.466 |
| XProtect VMS 23.2 | 23.2 → < 23.2.21.1.398 | 23.2.21.1.398 |
| XProtect VMS 23.1 | 23.1 → < 23.1.157.1.1470 | 23.1.157.1.1470 |
References
- supportcommunity.milestonesys.com supportcommunity.milestonesys.com
- supportcommunity.milestonesys.com supportcommunity.milestonesys.com
Timeline
- Published
- Last modified
Other CVEs of XProtect VMS
The 4 CVEs of XProtect VMS →
CVE-2025-1688
Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system…
5.5
Medium
CVE-2024-12569
Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras,…
5.2
Medium
CVE-2024-3506
A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to…
7.3
High