Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2025-0836

CVE-2025-0836: Milestone XProtect VMS Auth Bypass Flaw

CVE-2025-0836 is an authorization bypass in Milestone Systems XProtect VMS allowing read-only users to gain full read/write access to MIP Webhooks API. This article covers technical details, security impact, and remediation.

Published:

CVE-2025-0836 Overview

CVE-2025-0836 is a missing authorization vulnerability in Milestone Systems XProtect Video Management Software (VMS). The flaw resides in the Management Information Protocol (MIP) Webhooks API exposed by the Management Server. Users granted read-only access to the Management Server can perform full read and write operations against the MIP Webhooks API. This breaks the intended role-based access control model of the platform. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Low-privileged operators can create, modify, or delete webhook subscriptions, enabling data exfiltration of event streams or manipulation of downstream integrations tied to a surveillance environment.

Affected Products

Discovery Timeline

  • 2025-12-16 - CVE-2025-0836 published to the National Vulnerability Database (NVD)
  • 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0836

Vulnerability Analysis

Milestone XProtect VMS exposes a MIP Webhooks API through the Management Server. This API allows administrators to register HTTP callback endpoints that receive event notifications from the VMS. The API is intended to be restricted to administrative roles that can configure integrations.

Due to a broken access control check, the server does not verify whether the calling user holds the required write privileges before servicing MIP Webhooks API requests. As a result, any authenticated account with read-only Management Server access can issue write operations against the endpoint. An attacker with such an account can register arbitrary webhook destinations, modify existing subscriptions, or remove legitimate ones.

Root Cause

The root cause is a missing authorization check on MIP Webhooks API handlers within the Management Server. The API relies on authentication alone and does not enforce role-based permissions on state-changing operations. This aligns with the [CWE-862] pattern where a protected action is reachable without the corresponding privilege verification.

Attack Vector

Exploitation requires network reachability to the Management Server and any low-privilege authenticated account. The attacker calls the MIP Webhooks API endpoints and submits create, update, or delete operations for webhook subscriptions. Successful exploitation lets the attacker redirect surveillance event data to attacker-controlled infrastructure or disrupt SIEM and automation pipelines that consume XProtect webhook events.

No public proof-of-concept code is available for CVE-2025-0836. See the Milestone Systems advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-0836

Indicators of Compromise

  • New or modified MIP webhook subscriptions pointing to external or unfamiliar URLs
  • MIP Webhooks API write requests originating from accounts assigned only read-only Management Server roles
  • Unexpected outbound HTTP POST traffic from the XProtect Management Server to non-corporate endpoints

Detection Strategies

  • Audit the current list of registered MIP webhook subscriptions and compare against an approved baseline
  • Correlate Management Server access logs with webhook configuration changes to identify writes performed by non-administrative users
  • Alert on HTTP requests to MIP Webhooks API paths where the authenticated principal does not belong to an administrator group

Monitoring Recommendations

  • Enable verbose logging on the XProtect Management Server and forward logs to a centralized SIEM or data lake
  • Monitor egress traffic from Management Server hosts for anomalous destinations that could indicate rogue webhook targets
  • Track privileged API usage per user role and generate alerts on privilege-role mismatches

How to Mitigate CVE-2025-0836

Immediate Actions Required

  • Apply the cumulative XProtect VMS patch that addresses CVE-2025-0836 as listed in the Milestone Systems XProtect Patch List
  • Review all existing MIP webhook subscriptions and remove any that were not authorized by the VMS administrator
  • Rotate credentials for accounts that may have been used to abuse the API and reassess role assignments

Patch Information

Milestone Systems has released fixes distributed through the XProtect cumulative patch program. Administrators should identify the patched build for their installed XProtect release and deploy it to the Management Server. Consult the Milestone Systems CVE-2025-0836 Advisory for version-specific patch identifiers.

Workarounds

  • Restrict network access to the Management Server so that only administrative workstations can reach the MIP Webhooks API
  • Remove read-only Management Server access from accounts that do not require it until the patch is applied
  • Place the Management Server behind a reverse proxy or web application firewall that enforces path-based access rules for MIP API endpoints

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne