The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.

The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.

The Recording Server, Management Server, and Management Client on ports 6473/TCP local connection only, 7474/TCP, 8966/TCP local connection only, and port 9993/TCP use an exploitable .NET Framework Remoting deserialization level. The security vulnerability could be exploited by an attacker with access to the vulnerable ports and could allow elevation of privileges or causing a Denial-of-Service, compromising confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.