Security Flaw in Milestone XProtect Installer by Milestone Systems

CVE-2025-1688

What is CVE-2025-1688?

Milestone Systems has identified a security flaw in the Milestone XProtect installer that unintentionally resets the system configuration password during upgrades from specific older versions. This optional safety feature, which helps secure the Management Server, can be compromised, leading to potential unauthorized access. Organizations utilizing the 2024 R1 or 2024 R2 installers should take immediate action to update their system configuration passwords through the GUI to safeguard their installations. Systems that upgraded from the 2023 R3 version or older to the 2025 R1 and later are not impacted by this vulnerability.

References