{"id":"CVE-2025-0836","state":"PUBLISHED","title":"XProtect MIP API Missing Authorization","description":"Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.","publishedAt":"2025-12-16T11:02:25.199Z","updatedAt":"2025-12-16T14:51:38.048Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"Milestone"},"assigner":"Milestone","products":["Milestone Systems XProtect VMS"],"affected":[{"vendor":"Milestone Systems","product":"XProtect VMS","defaultStatus":"unaffected","versions":[{"version":"23.1","status":"affected","lessThan":"23.1.157.1.1470","versionType":"custom"},{"version":"23.2","status":"affected","lessThan":"23.2.21.1.398","versionType":"custom"},{"version":"23.3","status":"affected","lessThan":"23.3.72.1.466","versionType":"custom"},{"version":"24.1","status":"affected","lessThan":"24.1.12292.2279","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2.14561.2270","versionType":"custom"},{"version":"25.1","status":"affected","lessThan":"25.1.15990.2272","versionType":"custom"}],"modules":["webhooks"],"platforms":["Windows"]}],"references":["https://supportcommunity.milestonesys.com/s/article/CVE-2025-0836-XProtect-MIP-API-broken-access-control?language=en_US","https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-cumulative-patches-complete-list?language=en_US"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0836.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-0836","state":"PUBLISHED","datePublished":"2025-12-16T11:02:25.199Z","dateUpdated":"2025-12-16T14:51:38.048Z","assignerShortName":"Milestone","assignerOrgId":"cf45122d-9d50-442a-9b23-e05cde9943d8","dateReserved":"2025-01-29T13:24:34.734Z"},"containers":{"cna":{"title":"XProtect MIP API Missing Authorization","descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API."}],"affected":[{"vendor":"Milestone Systems","product":"XProtect VMS","defaultStatus":"unaffected","versions":[{"version":"23.1","status":"affected","lessThan":"23.1.157.1.1470","versionType":"custom"},{"version":"23.2","status":"affected","lessThan":"23.2.21.1.398","versionType":"custom"},{"version":"23.3","status":"affected","lessThan":"23.3.72.1.466","versionType":"custom"},{"version":"24.1","status":"affected","lessThan":"24.1.12292.2279","versionType":"custom"},{"version":"24.2","status":"affected","lessThan":"24.2.14561.2270","versionType":"custom"},{"version":"25.1","status":"affected","lessThan":"25.1.15990.2272","versionType":"custom"}],"modules":["webhooks"],"platforms":["Windows"]}],"references":[{"url":"https://supportcommunity.milestonesys.com/s/article/CVE-2025-0836-XProtect-MIP-API-broken-access-control?language=en_US","tags":["vendor-advisory"]},{"url":"https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-cumulative-patches-complete-list?language=en_US","tags":["patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Milestone","orgId":"cf45122d-9d50-442a-9b23-e05cde9943d8","dateUpdated":"2025-12-16T13:14:09.646Z"},"impacts":[{"capecId":"CAPEC-180","descriptions":[{"lang":"en","value":"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"To mitigate the issue, we highly recommend upgrading to the latest version of XProtect VMS, or at least to version 2025 R2 or later. The other option (for versions 2023 R1 – 2025 R1) is to use the provided cumulative patches (Knowledee Base article no. 34370 XProtect VMS cumulative patches). If, for any reason it is not possible, we recommend auditing your role security settings and considering everyone with read-only access to the Management Server as having a full access to Webhooks configuration."}],"value":"To mitigate the issue, we highly recommend upgrading to the latest version of XProtect VMS, or at least to version 2025 R2 or later. The other option (for versions 2023 R1 – 2025 R1) is to use the provided cumulative patches (Knowledee Base article no. 34370 XProtect VMS cumulative patches). If, for any reason it is not possible, we recommend auditing your role security settings and considering everyone with read-only access to the Management Server as having a full access to Webhooks configuration."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-16T14:51:28.827951Z","id":"CVE-2025-0836","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-16T14:51:38.048Z"}}]}}}