Executive brief
Network Optix Nx Witness VMS, a video management system used for IP camera surveillance, contains a security flaw in its web interface settings. If an administrator visits a malicious website while logged into the system, an attacker can steal their login credentials. This allows the attacker to take full control of the video management system, potentially viewing private camera feeds or altering security settings.
Technical details
A Cross-Origin Resource Sharing (CORS) misconfiguration exists in the REST API of Nx Witness VMS when running in the default 'Standard' security mode. The vulnerability stems from a permissive policy that allows 'Access-Control-Allow-Credentials' to be set to true alongside untrusted origins. An attacker can exploit this by enticing an authenticated administrator to visit a malicious cross-origin webpage, which then executes a client-side request to the VMS API to steal session tokens. This leads to full account takeover. The issue is resolved in version 6.1.2 by disabling credential sharing in the default configuration; users on older versions can manually patch the system settings via the REST API or switch to 'High' security mode.
Affected products
- Network Optix Nx Witness VMS before 6.1.2
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory