EUVD-2026-64898
GHSA-237w-25vx-r57c
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent vector confirmed by rogue-server-on-same-segment requirement; PR:N because the attacker needs no privileges on the victim VMS itself.
Primary rating from Vendor (NX).
CVSS VectorVendor: NX
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session token, resulting in Administrator Account Takeover. An attacker who controls an Nx server on the same network segment can set that server's site name to a script payload, which executes when an administrator opens the "Merge with Another Site" dialog and the site selection list is displayed.Solution:
Update to Nx Witness VMS version 6.1.3 or later.
AnalysisAI
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control or have compromised an Nx server located on the same network segment (adjacent network, AV:A per CVSS vector) as the target Nx Witness VMS deployment - this is the primary hard prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.0 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterizes the trade-off between meaningful impact and bounded reach: the adjacent-network vector (AV:A) is a genuine constraint that prevents internet-scale opportunistic exploitation, while the low attack complexity and full CIA triad impact at H/H/H reflect that, once adjacency is achieved, execution is straightforward and consequence is total administrator compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who operates or has compromised an Nx server on the same LAN segment as the target organization's Nx Witness VMS deployment renames that server's site to a JavaScript payload (e.g., a script tag that POSTs the document cookie to an external endpoint). When a legitimate administrator opens the web administration interface and navigates to the 'Merge with Another Site' dialog, the site selection list renders the attacker's site name without sanitization, executing the payload in the administrator's browser and transmitting the session token to the attacker. … |
| Remediation | The primary fix is to upgrade Nx Witness VMS to version 6.1.3 or later, as directed by the Network Optix security advisory at https://support.networkoptix.com/hc/en-us/articles/42950508518679-Security-Advisory-Cross-Site-Scripting-XSS-in-Merge-with-Another-Site-Dropdown. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Nx Witness VMS installations to identify systems running versions prior to 6.1.3 and restrict administrator access to trusted internal networks only, blocking connections from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nx Witness Vms
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today