EUVD-2026-43655
GHSA-qf7x-39m3-h7wc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API, high privileges required, scope changes to downstream VMS systems driving C:H/I:H/A:H; no special conditions beyond authentication.
Primary rating from Vendor (Milestone).
CVSS VectorVendor: Milestone
Lifecycle Timeline
1DescriptionCVE.org
Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API.
The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.
AnalysisAI
OS command injection in Milestone Systems XProtect Management Server API enables authenticated users with edit permissions to execute arbitrary code as the Management Server Service. The CWE-78 flaw is network-accessible (AV:N) and requires no user interaction beyond possessing a privileged account, with CVSS 4.0 scope change metrics indicating high downstream impact (SC:H/SI:H/SA:H) to the broader surveillance infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; Milestone has released patched versions addressed in their official advisory.
Technical ContextAI
Milestone Systems XProtect is a Video Management System (VMS) platform widely deployed in enterprise physical security environments. The Management Server API is a central orchestration component that manages cameras, recording servers, and operators. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that attacker-controlled input reaching the API is not properly sanitized before being passed to an OS-level command execution context, allowing shell metacharacter injection. The CPE string cpe:2.3:a:milestone_systems:xprotect_management_server:*:*:*:*:*:*:*:* with a wildcard version field implies all versions were considered vulnerable prior to the patch. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms the API is network-exposed and requires no special attack preconditions beyond holding edit-level credentials. The subsequent-system impact metrics (SC:H/SI:H/SA:H) reflect that the Management Server Service, once compromised, can affect connected recording servers, cameras, and downstream VMS components.
RemediationAI
Upgrade to the latest patched release of Milestone XProtect as specified in the vendor advisory at https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server - Milestone has released both a new version and cumulative patch updates, and the exact fix versions must be obtained from that source as they are not enumerated in currently available data. As compensating controls prior to patching, enforce strict least-privilege on Management Server accounts by removing edit permissions from any user account that does not operationally require them, reducing the attacker pool significantly. Restrict network access to the Management Server API to trusted management subnets or VPN-only segments, as the AV:N vector means a network-reachable API is the attack surface. Audit and rotate Management Server credentials, particularly for shared or high-turnover operator accounts. Note that restricting edit permissions may impact legitimate administrative workflows such as camera configuration and system management tasks.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today