Vulnerability · Published Dec 16, 2025 · Assigned by Milestone
CVE-2025-0836XProtect MIP API Missing Authorization
Medium 6.3
In plain English
A medium-severity missing authorization in XProtect VMS from Milestone Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 88.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Milestone Systems | XProtect VMS | 23.1 – before 23.1.157.1.147023.2 – before 23.2.21.1.39823.3 – before 23.3.72.1.46624.1 – before 24.1.12292.227924.2 – before 24.2.14561.227025.1 – before 25.1.15990.2272 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L