5.5
Medium
CVE-2025-1688 Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system…
Description
Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the Management Server. To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedure. Any system upgraded with 2024 R1 or 2024 R2 release installer is vulnerable to this issue. Systems upgraded from 2023 R3 or older with version 2025 R1 and newer are not affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| XProtect VMS 24.1 | 24.1 → 24.2 | No fix stated |
Other CVEs of XProtect VMS
The 4 CVEs of XProtect VMS →
CVE-2025-0836
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management…
5.3
Medium
CVE-2024-12569
Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras,…
5.2
Medium
CVE-2024-3506
A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to…
7.3
High