CVE-2026-78414 Overview
CVE-2026-78414 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Web Administration interface of Network Optix Nx Witness Video Management System (VMS) before version 6.1.3 on Linux, Windows, and macOS. An adjacent-network attacker who controls an Nx server on the same network segment can set that server's site name to a JavaScript payload. The payload executes in the browser of an authenticated administrator when the administrator opens the Merge with Another Site dialog. Successful exploitation results in session token theft and administrator account takeover of the target VMS deployment.
Critical Impact
Adjacent-network attackers can steal administrator session tokens and take over the Nx Witness VMS, gaining full control of connected video surveillance infrastructure.
Affected Products
- Network Optix Nx Witness VMS versions before 6.1.3 on Linux
- Network Optix Nx Witness VMS versions before 6.1.3 on Windows
- Network Optix Nx Witness VMS versions before 6.1.3 on macOS
Discovery Timeline
- 2026-08-24 - CVE-2026-78414 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-78414
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the Nx Witness VMS Web Administration interface. The application fails to sanitize or encode site name values before rendering them in the site selection list of the Merge with Another Site dialog. An attacker who operates a rogue Nx server on the same network segment as the target can assign an arbitrary script payload as the server's site name. When a legitimate administrator opens the merge dialog, the malicious site name is retrieved and rendered as HTML in the administrator's browser session. The injected JavaScript runs within the security context of the authenticated administrator, enabling theft of the session token and full administrator account takeover. Exploitation requires user interaction, since the payload only triggers when the administrator interacts with the merge workflow.
Root Cause
The root cause is improper neutralization of input during web page generation. The Web Administration interface trusts the site name attribute advertised by peer Nx servers on the local network and inserts it into the DOM without output encoding. This violates standard XSS prevention guidance for dynamic content rendered in HTML contexts.
Attack Vector
The attack vector is adjacent network. An attacker must control an Nx server that is discoverable on the same network segment as the target deployment. The attacker sets the rogue server's site name to a JavaScript payload. Exploitation completes when an authenticated administrator opens the Merge with Another Site dialog and the site selection list renders the malicious site name. No credentials are required from the attacker, but administrator interaction with the merge dialog is required. See the Network Optix Security Advisory for vendor technical details.
Detection Methods for CVE-2026-78414
Indicators of Compromise
- Unexpected Nx server instances advertised on internal network segments hosting Nx Witness VMS deployments.
- Nx server site names containing HTML tags, JavaScript keywords, or unusual character sequences such as <script>, onerror=, or javascript:.
- Administrator session tokens observed in outbound HTTP requests to unfamiliar external endpoints.
Detection Strategies
- Inspect VMS configuration and audit logs for site name values that deviate from organizational naming conventions.
- Monitor internal network segments for unauthorized Nx server discovery broadcasts and enumerate all site names visible to the VMS.
- Correlate administrator browser telemetry with VMS activity to detect anomalous script execution in the Web Administration interface.
Monitoring Recommendations
- Enable and centralize Nx Witness VMS audit logs, including site merge operations and administrator authentication events.
- Alert on new or unrecognized Nx servers appearing on network segments that host production VMS deployments.
- Track administrator session token usage from IP addresses or user agents that differ from expected administrator workstations.
How to Mitigate CVE-2026-78414
Immediate Actions Required
- Upgrade all Nx Witness VMS server and client components to version 6.1.3 or later on Linux, Windows, and macOS.
- Enumerate every Nx server reachable from VMS administrator workstations and validate that each is authorized and under organizational control.
- Rotate administrator credentials and invalidate active session tokens after patching to remove any tokens that may have been captured.
Patch Information
Network Optix has released Nx Witness VMS version 6.1.3, which remediates CVE-2026-78414. Administrators should apply the update on all affected operating systems. Refer to the Network Optix Security Advisory for release details and upgrade guidance.
Workarounds
- Restrict the network segment that hosts Nx Witness servers so only trusted, managed servers can join, using VLAN segmentation and firewall rules.
- Instruct administrators to avoid opening the Merge with Another Site dialog until the update to version 6.1.3 or later is applied.
- Limit Web Administration interface access to dedicated management workstations and enforce browser isolation for administrative sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
