Milestone XProtect Device Pack Camera Driver Buffer Overflow Vulnerability (CVE-2024-3506)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - CVE ID: CVE-2024-3506 - Vulnerability Type: Camera Driver possible Buffer Overflow - Impact: A buffer overflow vulnerability exists in the camera driver for XProtect Device Pack 13.1a or earlier versions. - Severity: CVSS v3.1 Base Score: 6.7 (Medium), CVSS v4.0 Score: 7.3 (High) 2. Affected Products: - Affected Product: Camera driver for XProtect Device Pack 13.1a or earlier versions. - Remediation: Install the latest Device Pack. 3. Workarounds and Mitigations: - Recommendation: Install the latest Device Pack to obtain updated drivers. - Warning: When adding new cameras, carefully scan verified and trusted IP addresses. 4. General Security Recommendations: - Recommendation: Protect network access to affected products using appropriate mechanisms. - Resource: Milestone Hardening Guide for running devices in a protected IT environment. 5. Product Description: - Definition: XProtect Device Pack is a set of drivers that interact with the XProtect system. - Installation: Automatically installed on recording servers during installation of the XProtect VMS system. - Update: Manually check and download the latest version from the Downloads section of the Milestone website. 6. Vulnerability Classification: - CVSS v3.1 Base Score: 6.7 - CVSS v4.0 Score: 7.3 7. Additional Information: - Contact: For further inquiries regarding security vulnerabilities in Milestone system products, contact the Milestone PSIRT team. 8. Historical Data: - Release Date: October 8, 2024 - Update Date: October 8, 2024 This information provides a detailed description of the vulnerability, affected products, mitigation measures, and security recommendations to help users understand and address this security risk.

Goal Reached Thanks to every supporter — we hit 100%!

Milestone XProtect Device Pack Camera Driver Buffer Overflow Vulnerability (CVE-2024-3506)