Description
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Milestone Systems | XProtect VMS | 23.1 – < 23.1.157.1.1470, 23.2 – < 23.2.21.1.398, 23.3 – < 23.3.72.1.466, 24.1 – < 24.1.12292.2279, 24.2 – < 24.2.14561.2270, 25.1 – < 25.1.15990.2272 | 23.1.157.1.1470 |
Advisories 3
- ICSA-26-043-07 Siemens Siveillance Video Management Servers CISA ICS & IT advisories · Feb 12, 2026
- NCSC-2026-0051 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 10, 2026
- SSA-625934 SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers Siemens ProductCERT · Feb 10, 2026