CVE-2025-0836: Milestone XProtect VMS Auth Bypass Flaw

CVE-2025-0836 Overview

CVE-2025-0836 is a missing authorization vulnerability in Milestone Systems XProtect Video Management Software (VMS). The flaw resides in the Management Information Protocol (MIP) Webhooks API exposed by the Management Server. Users granted read-only access to the Management Server can perform full read and write operations against the MIP Webhooks API. This breaks the intended role-based access control model of the platform. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Low-privileged operators can create, modify, or delete webhook subscriptions, enabling data exfiltration of event streams or manipulation of downstream integrations tied to a surveillance environment.

Affected Products

Milestone Systems XProtect VMS - Management Server component
Milestone Systems XProtect MIP Webhooks API
Refer to the Milestone Systems CVE-2025-0836 Advisory for the full list of affected versions

Discovery Timeline

2025-12-16 - CVE-2025-0836 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0836

Vulnerability Analysis

Milestone XProtect VMS exposes a MIP Webhooks API through the Management Server. This API allows administrators to register HTTP callback endpoints that receive event notifications from the VMS. The API is intended to be restricted to administrative roles that can configure integrations.

Due to a broken access control check, the server does not verify whether the calling user holds the required write privileges before servicing MIP Webhooks API requests. As a result, any authenticated account with read-only Management Server access can issue write operations against the endpoint. An attacker with such an account can register arbitrary webhook destinations, modify existing subscriptions, or remove legitimate ones.

Root Cause

The root cause is a missing authorization check on MIP Webhooks API handlers within the Management Server. The API relies on authentication alone and does not enforce role-based permissions on state-changing operations. This aligns with the [CWE-862] pattern where a protected action is reachable without the corresponding privilege verification.

Attack Vector

Exploitation requires network reachability to the Management Server and any low-privilege authenticated account. The attacker calls the MIP Webhooks API endpoints and submits create, update, or delete operations for webhook subscriptions. Successful exploitation lets the attacker redirect surveillance event data to attacker-controlled infrastructure or disrupt SIEM and automation pipelines that consume XProtect webhook events.

No public proof-of-concept code is available for CVE-2025-0836. See the Milestone Systems advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-0836

Indicators of Compromise

New or modified MIP webhook subscriptions pointing to external or unfamiliar URLs
MIP Webhooks API write requests originating from accounts assigned only read-only Management Server roles
Unexpected outbound HTTP POST traffic from the XProtect Management Server to non-corporate endpoints

Detection Strategies

Audit the current list of registered MIP webhook subscriptions and compare against an approved baseline
Correlate Management Server access logs with webhook configuration changes to identify writes performed by non-administrative users
Alert on HTTP requests to MIP Webhooks API paths where the authenticated principal does not belong to an administrator group

Monitoring Recommendations

Enable verbose logging on the XProtect Management Server and forward logs to a centralized SIEM or data lake
Monitor egress traffic from Management Server hosts for anomalous destinations that could indicate rogue webhook targets
Track privileged API usage per user role and generate alerts on privilege-role mismatches

How to Mitigate CVE-2025-0836

Immediate Actions Required

Apply the cumulative XProtect VMS patch that addresses CVE-2025-0836 as listed in the Milestone Systems XProtect Patch List
Review all existing MIP webhook subscriptions and remove any that were not authorized by the VMS administrator
Rotate credentials for accounts that may have been used to abuse the API and reassess role assignments

Patch Information

Milestone Systems has released fixes distributed through the XProtect cumulative patch program. Administrators should identify the patched build for their installed XProtect release and deploy it to the Management Server. Consult the Milestone Systems CVE-2025-0836 Advisory for version-specific patch identifiers.

Workarounds

Restrict network access to the Management Server so that only administrative workstations can reach the MIP Webhooks API
Remove read-only Management Server access from accounts that do not require it until the patch is applied
Place the Management Server behind a reverse proxy or web application firewall that enforces path-based access rules for MIP API endpoints