CVE-2018-7891

HIGH

Milestone XProtect <12.1a - Remote Code Execution

Title source: llm

Description

The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/104120

[Mitigation, Third Party Advisory] https://cert-portal.siemens.com/productcert/pdf/ssa-457058.pdf

[Vendor Advisory] https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-NET-security-vulnerability-hotfixes-for-2016-R1-2018-R1?language=en_US

Scores

CVSS v3 8.1

EPSS 0.0268

EPSS Percentile 85.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (6)

milestonesys/xprotect < 12.1a

siemens/siveillance_vms < 10.0a

Timeline

Published Apr 30, 2018

Tracked Since Feb 18, 2026