PT-2018-18309 · Milestone · Milestone Xprotect Video Management

Published 1999-01-01 · Updated 2018-06-13 · CVE-2018-7891

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) versions 2016 R1 (10.0.a) through 2018 R1 (12.1a)

Description: The issue concerns .NET Remoting endpoints that are vulnerable to deserialization attacks, which can result in remote code execution.

Recommendations: For versions 2016 R1 (10.0.a) through 2018 R1 (12.1a), consider disabling the .NET Remoting endpoints as a temporary workaround until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-7891

DOTNETREMOTINGCHECK

Affected Products

Milestone Xprotect Video Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-7891 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7891 · Vendor Advisory
• https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-NET-security-vulnerability-hotfixes-for-2016-R1-2018-R1?language=en_US · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-457058.pdf · Note
• http://securityfocus.com/bid/104120 · Note