CVE-2026-78414 in Nx Witness VMS
Summary
by MITRE • 08/24/2026
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session token, resulting in Administrator Account Takeover. An attacker who controls an Nx server on the same network segment can set that server's site name to a script payload, which executes when an administrator opens the "Merge with Another Site" dialog and the site selection list is displayed.Solution:
Update to Nx Witness VMS version 6.1.3 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Network Optix Nx Witness Video Management Software prior to version 6.1.3 represents a critical security flaw within its Web Administration interface, specifically classified as Cross-Site Scripting. This weakness allows an attacker operating on the same network segment as the target server to execute arbitrary JavaScript code within the context of an authenticated administrator's browser session. The attack vector is particularly insidious because it does not require complex social engineering or external remote exploitation; instead, it leverages a trusted administrative action performed by the victim against a compromised peer device on the local area network. By manipulating the site name configuration of a controlled Nx server to contain malicious script payloads, an attacker can trigger code execution when an administrator interacts with specific interface elements designed for multi-site management operations.
The technical mechanism of this vulnerability centers on insufficient input validation and output encoding within the "Merge with Another Site" dialog functionality. When an authenticated administrator initiates the process to merge configurations from another site, the system retrieves a list of available sites from the network. If one of these sites has been configured by an attacker to include JavaScript in its name field, this payload is rendered directly into the DOM without proper sanitization or encoding. Consequently, when the browser parses and displays the site selection list, it executes the embedded script as if it were part of the legitimate administrative application code. This bypasses same-origin policy protections because the malicious content originates from a domain that the administrator has already authenticated against, effectively granting the attacker full trust context within the administration console.
The operational impact of this vulnerability is severe, leading directly to Administrator Account Takeover. Once the JavaScript payload executes in the victim's browser, it can perform various hostile actions depending on the specific code injected by the attacker. The most critical consequence is the theft of session tokens and authentication cookies associated with the administrator account. With these credentials captured, an attacker gains unrestricted access to the Nx Witness VMS administrative interface. This level of access allows for comprehensive control over video surveillance infrastructure, including the ability to view live feeds, manipulate recording schedules, alter user permissions, disable security alerts, or even exfiltrate sensitive video data stored on the server. The compromise extends beyond mere data theft; it undermines the integrity and availability of critical physical security systems managed by the VMS.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under stored or reflected XSS variants where user-controllable input is not properly encoded before being included in web pages served to other users. In terms of the MITRE ATT&CK framework, this attack maps to techniques involving Client-Side Injection and potentially Credential Access through Browser Session Hijacking. The ability for an adjacent-network attacker to exploit this flaw highlights a broader architectural concern regarding trust boundaries within local networks, where devices are often assumed to be secure by default unless explicitly hardened against lateral movement attacks.
Mitigation strategies must prioritize immediate software remediation as the primary defense mechanism. Network administrators should upgrade all Nx Witness VMS installations to version 6.1.3 or any later release that includes patches for this specific input validation flaw. Until such an update can be applied, temporary mitigations may include restricting access to the Web Administration interface through network segmentation and firewall rules to prevent adjacent-network devices from reaching the administrative ports. Additionally, implementing strict Content Security Policy headers within the web application configuration could help mitigate some effects of script execution by limiting allowed sources for scripts, although this is a compensating control rather than a fix for the underlying code defect. Regular vulnerability scanning and monitoring for unusual administrative login patterns can also aid in detecting potential exploitation attempts before significant damage occurs.