Siemens Siveillance Video Management Servers
The Webhooks implementation of Siveillance Video Management Servers contains a vulnerability that could allow an authenticated remote attacker with read-only privileges to achieve full access to Webhooks API. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-0836US | —OT elevated | — | ||
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API. | ||||
references
External citations — patches, advisories, analysis.
- SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers - CSAF Versionself
- SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers - HTML Versionself
- ICS Advisory ICSA-26-043-07 JSONself
- ICS Advisory ICSA-26-043-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationSiveillance Video V2023 R1
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2023 R2
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2023 R3
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2024 R1
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- MitigationSiveillance Video V2025
If, for any reason it is not possible to install the latest patch, we recommend auditing your role security settings and consider everyone with read-only access to the Management Server as having a full access to Webhooks configuration.
- FixedSiveillance Video V2023 R1
Update to V23.1 HotfixRev18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820659/ - FixedSiveillance Video V2023 R2
Update to V23.2 HotfixRev18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823922/ - FixedSiveillance Video V2023 R3
Update to V23.3 HotfixRev23 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827783/ - FixedSiveillance Video V2024 R1
Update to V24.1 HotfixRev14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109976123/ - FixedSiveillance Video V2025
Update to V25.1 HotfixRev8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109988670/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan