Executive brief
C-MOR Video Surveillance is a video management system used to monitor cameras, view recordings, and control PTZ (pan-tilt-zoom) cameras through a web interface. A reflected cross-site scripting vulnerability in this web interface allows an attacker to inject malicious JavaScript code that executes in the browser of a logged-in administrator, potentially enabling account hijacking, access to live and recorded video feeds, credential theft via phishing, and lateral movement to other systems on the network.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) in the C-MOR Video Surveillance web interface. The vulnerability exists in two components: the ptzpreset.pml page (via the size parameter) and the show-movies.pml page. The root cause is improper input validation and lack of HTML/JavaScript context-aware output encoding—user-supplied parameters are inserted directly into HTML attributes and JavaScript code without sanitization. An attacker must trick an authenticated administrator into clicking a malicious link; the injected JavaScript then executes with the privileges of that administrator. An attacker can steal session tokens, exfiltrate video data, modify system configuration, or use the system as a foothold for internal network reconnaissance. Patch availability from the vendor has not been confirmed in the advisory text.
Affected products
- za-internet GmbH C-MOR Video Surveillance up to and including V6.0104
Timeline
- 2026-07-23: disclosed
- 2026-09-15: advisory