CVE-2026-66372

Digital Watchdog VMAX DVR and NVR devices generate web session tokens from insufficiently random values, so token entropy is bounded by the underlying seed space and the tokens can be predicted (CWE-337). An attacker who can reach the device's web interface — over an adjacent network segment or via an internet-exposed port — could predict valid session tokens and hijack an authenticated user's session, inheriting that user's access to live video, recorded footage, and device configuration. Exploitation requires no privileges or user interaction, though the CVSS 4.0 vector (7.6, high) rates it as adjacent-network with high attack complexity, and it impacts confidentiality and integrity but not availability. The affected scope covers the Digital Watchdog VMAX DVR and VMAX NVR product lineups; specific firmware versions were not enumerated in the CVE data, so defenders should verify with the vendor advisory. There is no known public PoC, no observed exploitation, and the flaw is not in CISA's KEV catalog.

What to do: Apply Digital Watchdog firmware updates for VMAX DVR/NVR devices as soon as patched builds are released, confirming affected model/firmware combinations with DW support since the CVE data lists no versions. Until patched, remove VMAX web interfaces from the internet (disable UPnP and port forwarding, restrict access to VPN or firewall allow-lists), and invalidate active sessions and rotate operator credentials after updating. Review device and account logs for unexplained session activity or unfamiliar logins.