VMS security

A VMS carries the privileges of an operator console on a Windows server whose operating system its own vendor declines to cover.

TCP 7563 moves video and PTZ commands. TCP 5210 merges databases after a failover. TCP 1234, 1235 and 9090 take events in from systems that are not part of the product. HTTP 80 on the management server is documented as "Main communication, for example, authentication and configurations".¹ Nothing in that list is specific to video. It is the anatomy of a mid-sized enterprise application: web tier, database, event bus, thick client. It usually arrives in the building inside a camera contract.

What is actually deployed#

A deployment is several Windows servers with different jobs. The management server holds configuration, users and licensing, and every client authenticates against it. Recording servers do the ingest: they hold the camera credentials and own the storage volumes. An event server takes events in from elsewhere. A mobile server terminates authentication and re-streams video to phones and browsers. Genetec Security Center is the same anatomy under different names — a Directory that every role and client reaches on TCP 5500 over TLS 1.2, with the Archiver, Media Router and Media Gateway as separate roles listening on separate ports.²

The listeners below are the vendors' own, with one caveat that matters before anyone writes a rule from them. The Milestone numbers come from the 2020R3 documentation edition, because on 5 September 2026 the "latest" ports page returned only the documentation-portal shell. They are about six years old and should be checked against your release. The Genetec figures come from the 5.13 page; where it and the 5.9–5.12 firewall page disagree, we could not establish which governs a 2026 install.

The management server also listens on TCP 6473, TCP 8080 and HTTP 9000, and a DLNA server sits on HTTP 9100 and 9200; our reading of the page did not capture a stated purpose for any of them.

The listeners that take input from outside#

Three rows in that table are different in kind from the rest. TCP 1234 and 1235 accept "generic events from external systems or devices", and TCP 9090 accepts analytics events. These are the ports that take unauthenticated-by-design external input into the VMS event pipeline: the integration model is that an access controller or an analytics box can raise an event without holding a VMS credential. Whatever network rule stands in front of them is doing all of the access control. The port documentation does not describe what validation sits behind them, and we did not test it.

TCP 5432 is the row to check against your own scan output. Milestone documents it on the recording server as carrying device event messages, and as disabled by default. It is also the IANA-registered PostgreSQL port, so a scanner labelling services from the port registry will report a database. A finding of "PostgreSQL exposed" across a set of recording servers is worth opening before it turns into a remediation ticket against a database nobody can find, and a 5432 that genuinely is answering is a configuration someone should be able to explain.

Administrator on the VMS is administrator on the server#

Milestone's most recent public advisory as of 5 September 2026 is CVE-2026-3014, "potential remote code execution by administrative user on the Management Server", last updated 15 July 2026.³ A role granted inside the video application converts to code execution on the Windows host underneath it.

There is a tension in Milestone's own documents worth reading carefully. The vulnerability management policy places out of scope "vulnerabilities requiring highly privileged account permissions as a prerequisite".⁴ CVE-2026-3014 is exactly that shape, and Milestone published it anyway. Where the line falls is not stated.

That administrator role is usually handed out through directory groups, and a nested group inherits everything the role can reach. The people who maintain those groups maintain door lists. Read the directory-to-role mapping out of the running configuration; the documentation describes the product, not your instance. One more thing about the management server's port table: it separates "authentication and configurations" on 80 from "authentication of basic users" on 443, which reads like two user populations on two paths. Milestone does not say that, and we are inferring it.

RTSP answering on a Windows host#

The Milestone Open Network Bridge listens on RTSP 554 and streams video to ONVIF clients, with TCP 580 for authentication and stream configuration.¹ Genetec answers RTSP on the server side in two places: the Media Router on 554 and the Media Gateway on 654.² Port 554 open on a Windows host is therefore no evidence of a camera. That matters for anyone reconciling a scan result against a camera count, and for anyone writing an ACL that treats 554 as camera traffic by definition.

The mobile server belongs in the same conversation. It terminates authentication and re-streams video over HTTP 8081 or HTTPS 8082, which puts it in the same review category as any other externally reachable web service, whatever the project called it.

Server-side listeners are only half of it. The Genetec Archiver reaches cameras outbound on TCP 80, 443, 554 and 322 — the camera's own ports, initiated from the server.⁵ Its inbound live-unicast range is wide enough that camera-VLAN rules get written loosely to accommodate it; the arithmetic is worked through in camera network segmentation.

What the vendor's policy does not cover#

Milestone's vulnerability management policy places out of scope, in writing, "all Microsoft Windows and third-party Windows software issues", along with DLL hijacking and sideloading on Windows, third-party plug-ins and integrations, and products in the "Terminated" state.⁴ That is the VMS vendor stating that it does not own the operating system your recording servers run on.

Whether anything else owns it is a question about your own asset register, and we cannot answer it from a source. Our own observation, offered as that and not as a measurement, is that these hosts are commissioned inside a camera project and enter the asset register, if they enter it at all, under the name of the video system. We have found no published measurement of how common that is.

Access to the fix is a separate matter, and that one is documented. Milestone's software download page and the advisory URL it registered with the CVE Program both redirect to the same Entra identity tenant.⁶ Reading the advisory and downloading the patch require an account on the same tenant.

Patching an XProtect estate#

Milestone's registered CNA scope is "Supported Milestone XProtect products", so a defect in an out-of-support XProtect release cannot receive a CVE identifier from its own vendor.⁷ The rest of the vendor-by-vendor picture is set out in which vendors publish advisories: who publishes, where, and whether the advisories carry dates. What is specific to a VMS is the change window: restarting a recording server puts a gap in the recording, and that, rather than the availability of the patch, is usually what sets the date.

The device list#

The VMS device list is the most accurate inventory of the estate, because the operation depends on it being right; hardening a video estate covers how to use it and what it leaves out. The reason it has no substitute is that a properly segmented camera VLAN is exactly what a corporate vulnerability scanner does not reach.