CVE-2026-51133: C-MOR Video Surveillance XSS Vulnerability

CVE-2026-51133 Overview

CVE-2026-51133 is a reflected Cross-Site Scripting (XSS) vulnerability affecting za-internet GmbH C-MOR Video Surveillance versions up to and including V6.0104. The flaw resides in the size parameter processed by the ptzpreset.pml and showmovies.pml components. A remote attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in the victim's browser context, enabling session hijacking, credential theft, and unauthorized actions against the C-MOR surveillance interface.

Affected Products

za-internet GmbH C-MOR Video Surveillance versions <= V6.0104
ptzpreset.pml component (vulnerable size parameter)
showmovies.pml component (vulnerable size parameter)

Discovery Timeline

2026-09-15 - CVE-2026-51133 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-51133

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the C-MOR Video Surveillance web interface. User-supplied input passed through the size HTTP parameter is echoed back into the rendered HTML response without proper output encoding or sanitization. This affects two distinct endpoints: ptzpreset.pml, which handles pan-tilt-zoom camera preset configuration, and showmovies.pml, which serves recorded video content.

Exploitation requires user interaction, meaning an attacker must convince an authenticated administrator to click a crafted link. Because the scope is changed, the injected script runs in the origin of the C-MOR management interface and can access session cookies, DOM content, and any camera control functions available to the victim. Refer to the Albcyberguards CVE-2026-51133 Analysis for reproduction details.

Root Cause

The root cause is missing input validation and output encoding on the size GET parameter within the two .pml handlers. The application concatenates the parameter value directly into HTML output without applying context-aware escaping, violating standard defensive coding practices for web applications.

Attack Vector

The attack requires network access to the C-MOR web interface and one instance of user interaction. An attacker constructs a URL containing a malicious size parameter value carrying JavaScript payload syntax. When the victim loads the URL, the payload is reflected into the response body and executed by the browser. Because C-MOR is a video surveillance platform, a successful XSS attack can be used to pivot toward unauthorized camera control, deletion of recorded footage, or theft of administrator session tokens.

No verified public exploit code is available; the vulnerability mechanism is described in prose based on the vendor advisory data and third-party analysis linked above.

Detection Methods for CVE-2026-51133

Indicators of Compromise

HTTP GET requests to /ptzpreset.pml or /showmovies.pml containing script syntax such as <script>, onerror=, javascript:, or encoded variants within the size parameter.
Web server access logs showing anomalous size parameter values with unusual length or URL-encoded HTML metacharacters (%3C, %3E, %22).
Referer headers pointing to external domains, phishing pages, or URL shorteners preceding requests to the affected endpoints.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the size query parameter on C-MOR endpoints for HTML and JavaScript injection patterns.
Enable verbose HTTP request logging on the C-MOR host and forward logs to a centralized SIEM for correlation against known XSS payload signatures.
Perform periodic authenticated scanning of the C-MOR interface with a dynamic application security testing (DAST) tool configured to fuzz reflected parameters.

Monitoring Recommendations

Alert on outbound network connections from administrator workstations to unexpected destinations following visits to the C-MOR interface, which may indicate cookie or credential exfiltration.
Monitor for administrative actions in C-MOR (camera reconfiguration, footage deletion) that occur outside normal operator hours.
Track browser-side Content Security Policy (CSP) violation reports if a CSP is deployed in front of the surveillance application.

How to Mitigate CVE-2026-51133

Immediate Actions Required

Restrict network access to the C-MOR management interface to trusted administrator subnets only, using firewall rules or VPN gating.
Instruct administrators to avoid clicking links to C-MOR URLs received via email, chat, or external sites until a patched build is deployed.
Review the C-MOR Video Surveillance Change Log for a fixed release and upgrade as soon as one is available.

Patch Information

The vendor advisory data lists all C-MOR Video Surveillance versions up to and including V6.0104 as vulnerable. Administrators should consult the C-MOR Video Surveillance Change Log for the current fixed version and apply the vendor-supplied update. No CISA KEV entry exists for this CVE at the time of publication.

Workarounds

Place the C-MOR web interface behind a reverse proxy that strips or encodes HTML metacharacters in the size query parameter for ptzpreset.pml and showmovies.pml.
Deploy a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected XSS.
Use browser session isolation, ensuring administrators access C-MOR from a dedicated browser profile with no shared cookies or credentials.

bash

# Example nginx reverse-proxy rule to block script-like patterns in the size parameter
location ~ ^/(ptzpreset|showmovies)\.pml$ {
    if ($arg_size ~* "(<|%3C|script|onerror|javascript:)") {
        return 403;
    }
    proxy_pass http://cmor_backend;
}