« Volver al listado

CVE-2026-10056

Estado: Pendiente de análisisAlta (7.5)—

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account Takeover via a malicious cross-origin web page visited by the victim. The High security mode is not affected.Workaround:

For existing installations running in Standard security mode, set Access-Control-Allow-Credentials to false via the REST API: PATCH /rest/v2/system/settings with body {"supportedOrigins": "null"}. Alternatively, select High security level during initial setup.

Leer descripción completaMostrar menos

Solution:

Update to Nx Witness VMS version 6.1.2 or later, in which Access-Control-Allow-Credentials is set to false in the default Standard security configuration.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS via CORS misconfiguration en página web maliciosa (vector UI:R remoto). El atacante roba token de sesión (T1212) para ejecutar Account Takeover (T1078, T1098) de cuenta administrador.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Developer GuidanceUser TrainingUser Account ManagementPrivileged Account ManagementMulti-factor AuthenticationApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Networkoptix — NX Witness VMSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-10056",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10056",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-29T14:58:57.225339Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "96d4e157-0bf0-48b3-8efd-382c68caf4e0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "96d4e157-0bf0-48b3-8efd-382c68caf4e0",
      "affectedData": [
        {
          "vendor": "Network Optix",
          "product": "Nx Witness VMS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.1.2",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux",
            "Windows",
            "MacOS"
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T09:16:17.147",
  "references": [
    {
      "url": "https://support.networkoptix.com/hc/en-us/articles/39254208939159-How-to-Enable-CORS-Validation",
      "source": "96d4e157-0bf0-48b3-8efd-382c68caf4e0"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "96d4e157-0bf0-48b3-8efd-382c68caf4e0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account Takeover via a malicious cross-origin web page visited by the victim. The High security mode is not affected.Workaround:\n\nFor existing installations running in Standard security mode, set Access-Control-Allow-Credentials to false via the REST API: PATCH /rest/v2/system/settings with body {\"supportedOrigins\": \"null\"}. Alternatively, select High security level during initial setup.\n\nSolution:\n\nUpdate to Nx Witness VMS version 6.1.2 or later, in which Access-Control-Allow-Credentials is set to false in the default Standard security configuration."
    },
    {
      "lang": "es",
      "value": "Mala configuración de CORS en la API REST de Network Optix Nx Witness VMS anterior a la versión 6.1.2, cuando se ejecuta en el modo de seguridad 'Estándar' predeterminado, en Linux y Windows permite a un atacante remoto no autenticado robar el token de sesión de un usuario autenticado y realizar una 'Toma de Control de Cuenta de Administrador' a través de una página web maliciosa de origen cruzado visitada por la víctima. El modo de seguridad 'Alto' no se ve afectado.\n\nSolución alternativa:\n\nPara instalaciones existentes que se ejecutan en el modo de seguridad 'Estándar', establezca 'Access-Control-Allow-Credentials' en 'false' a través de la API REST: PATCH /rest/v2/system/settings con el cuerpo {\"supportedOrigins\": \"null\"}. Alternativamente, seleccione el nivel de seguridad 'Alto' durante la configuración inicial.\n\nSolución:\n\nActualice a la versión 6.1.2 o posterior de Nx Witness VMS, en la que 'Access-Control-Allow-Credentials' se establece en 'false' en la configuración de seguridad 'Estándar' predeterminada."
    }
  ],
  "lastModified": "2026-07-21T12:10:00.090",
  "sourceIdentifier": "96d4e157-0bf0-48b3-8efd-382c68caf4e0"
}