PT-2024-17657 · Milestone+1 · Milestone Xprotect Device Pack+1

Published

2024-12-19

·

Updated

2025-01-23

·

CVE-2024-12569

CVSS v3.1

7.8

High

VectorAV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Milestone XProtect Device Pack (affected versions not specified) HikVision camera driver in XProtect Device Pack (affected versions not specified)
Description The issue is related to the disclosure of sensitive information in a log file of the Milestone XProtect Device Pack driver for third-party cameras. This allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
Recommendations For Milestone XProtect Device Pack, consider restricting access to the log files to minimize the risk of exploitation. For HikVision camera driver in XProtect Device Pack, avoid using the affected driver until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-01511
CVE-2024-12569

Affected Products

Hikvision Camera Driver
Milestone Xprotect Device Pack