CVE-2026-78414: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Network Optix Nx Witness VMS

This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Nx Witness VMS Web Administration interface. An attacker on the same network segment who controls an Nx server can inject a script payload into the site name. When an administrator opens the "Merge with Another Site" dialog, the malicious script executes in the administrator's browser, enabling session token theft and administrator account takeover. The issue affects versions prior to 6.1.3 on all supported platforms. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring user interaction.

Successful exploitation allows an adjacent-network attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser, resulting in theft of the administrator's session token and full administrator account takeover. This compromises the confidentiality, integrity, and availability of the Nx Witness VMS system managed by the administrator.

The vendor advises updating Nx Witness VMS to version 6.1.3 or later to remediate this vulnerability. No official patch or temporary fix details are provided beyond this update recommendation. Until updated, administrators should be cautious when merging sites and avoid interacting with untrusted Nx servers on the same network segment.