TI-2025-00708 Aliases CVE-2025-0836 GHSA-mrcm-cqrc-38qw

XProtect MIP API Missing Authorization

LOW 23CWE-862Published 2025-12-16 · Updated 2025-12-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00213 11th percentileScored 2026-11-07

Fix Fixed XProtect VMS (Milestone Systems): 23.1.157.1.1470, 23.2.21.1.398, 23.3.72.1.466 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Milestone Systems	XProtect VMS	23.1 to before 23.1.157.1.1470; 23.2 to before 23.2.21.1.398; 23.3 to before 23.3.72.1.466; 24.1 to before 24.1.12292.2279; 24.2 to before 24.2.14561.2270; 25.1 to before 25.1.15990.2272	23.1.157.1.1470, 23.2.21.1.398, 23.3.72.1.466, 24.1.12292.2279, 24.2.14561.2270, 25.1.15990.2272	Patch available	CNA

XProtect VMS VendorMilestone Systems Affected 23.1 to before 23.1.157.1.1470; 23.2 to before 23.2.21.1.398; 23.3 to before 23.3.72.1.466; 24.1 to before 24.1.12292.2279; 24.2 to before 24.2.14561.2270; 25.1 to before 25.1.15990.2272 Fixed in 23.1.157.1.1470, 23.2.21.1.398, 23.3.72.1.466, 24.1.12292.2279, 24.2.14561.2270, 25.1.15990.2272 Patch available CNA

Remediation

Fix · CNA XProtect VMS (Milestone Systems) Fixed in 23.1.157.1.1470, 23.2.21.1.398, 23.3.72.1.466, 24.1.12292.2279, 24.2.14561.2270, 25.1.15990.2272

Timeline

2026-10-02 Threatist record created from CVE-2025-0836
2026-10-03 Alias added: GHSA-mrcm-cqrc-38qw

References

Patch 1

https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-cumulative-patches-complete-list?language=en_US

Advisory 1

https://supportcommunity.milestonesys.com/s/article/CVE-2025-0836-XProtect-MIP-API-broken-access-control?language=en_US

TI-2024-03270 Camera Driver possible Buffer Overflow CVSS 4.0HIGH 7.3
TI-2026-02603 Remote Code Execution by administrative user on the Management Server CVSS 4.0MEDIUM 6.4
TI-2024-11662 Sensitive Information in Driver’s Log File CVSS 4.0MEDIUM 5.2
TI-2025-01451 System configuration password reset CVSS 4.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences