CVSS v3.1 Base Score: 9.9 SUMMARY Milestone has released a software update for Milestone VMS, which fixes a security vulnerability with a possible Remote Code Execution by an authenticated user on the Management Server service. AFFECTED PRODUCTS AND SOLUTIONS  

  WORKAROUNDS AND MITIGATIONS There are currently no known workarounds. Please update your system. GENERAL SECURITY RECOMMENDATIONS  As a general security measure Milestone strongly recommends protecting network access to affected products with appropriate mechanisms. It is advised to follow the security practices recommended in the Milestone Hardening Guide to run the devices in a protected IT environment. PRODUCT DESCRIPTION The management server is the central component of the VMS system. It stores the configuration of the surveillance system in an SQL database, either on a SQL Server on the management server computer itself or on a separate SQL Server on the network. It also handles user authentication, user permissions, the rule system and more. To improve system performance, you can run several management servers as a Milestone Federated Architecture™. The management server runs as a service and is typically installed on a dedicated server. Users connect to the management server for initial authentication, then transparently to the recording servers for access to video recordings, etc. VULNERABILITY CLASSIFICATION The vulnerability classification has been performed by using the CVSS scoring system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss). The CVSS environmental score is specific to the customer’s environment and will impact the overall CVSS score. The environmental score should therefore be individually defined by the customer to accomplish final scoring. At the time of advisory publication, no public exploitation of this security vulnerability was known. Milestone confirms the security vulnerability and provides mitigations to resolve the security issue.  CVSS v3.1 Base Score 9.9 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H   ADDITIONAL INFORMATION For further inquiries on security vulnerabilities in Milestone Systems products, please contact Milestone PSIRT Team: https://www.milestonesys.com/psirt   HISTORY DATA V1.0 (09.05.2023): Publication Date