Xprotect Vms
Approved changes feed: RSS · Atom
cpe:2.3:a:milestone_systems:xprotect_vms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Milestone Systems (6b96f63c-e04e-559e-8f82-eb980128ab29) |
|---|---|
| Product | Xprotect Vms (1517f0cd-3247-5cc2-bef0-68a914023ed9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-1688 |
vulnerable | 2026-06-08 07:08:37.589255 |
System configuration password reset
MEDIUM (5.5)
Milestone Systems has discovered a
security vulnerability in Milestone XProtect installer that resets system
configuration password after the upgrading from older versions using specific
installers.
The system configuration
password is an additional, optional protection that is enabled on the
Management Server.
To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedure.
Any system upgraded with
2024 R1 or 2024 R2 release installer is vulnerable to this issue.
Systems upgraded from 2023
R3 or older with version 2025 R1 and newer are not affected.
Published: 2025-04-15T10:13:51.549Z
Updated: 2025-09-09T07:51:13.969Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0836 |
vulnerable | 2026-06-08 07:02:25.663537 |
XProtect MIP API Missing Authorization
MEDIUM (6.3)
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.
Published: 2025-12-16T11:02:25.199Z
Updated: 2025-12-16T14:51:38.048Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3506 |
vulnerable | 2026-06-08 06:41:53.487114 |
Camera Driver possible Buffer Overflow
MEDIUM (6.7)
A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on Recording Server under strict conditions.
Published: 2024-10-08T10:00:38.099Z
Updated: 2024-10-08T13:50:58.073Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12569 |
vulnerable | 2026-06-08 06:25:35.559390 |
Sensitive Information in Driver’s Log File
HIGH (7.8)
Disclosure
of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera
credentials stored in the Recording Server under specific conditions.
Published: 2024-12-19T08:41:33.342Z
Updated: 2025-08-28T14:41:37.061Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.