CVE-2026-66887

Digital Watchdog VMAX DVRs and NVRs are missing authorization checks on state-changing CGI endpoints and perform no session validation, so requests that modify device state can be accepted without a valid authenticated session (CWE-862). An attacker who can reach the recorder on the same network segment (CVSS attack vector is adjacent-network, with no privileges or user interaction required) can invoke these CGIs directly and change device configuration or behavior, with critical-rated impacts on the confidentiality, integrity, and availability of the recorder and dependent systems such as recorded video and surveillance operations. Organizations running VMAX DVR/NVR appliances — typically commercial and physical-security video deployments — are affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild, though exposed recorder web interfaces are routine targets once network access is obtained.

What to do: Apply the vendor firmware update for the VMAX DVR/NVR lineups as described in the ICS-CERT advisory and confirm the patched build is running. Because exploitation requires adjacent-network access, place recorders on a dedicated VLAN or behind firewall rules so only trusted clients can reach their CGI/web endpoints. Rotate any default credentials and review device logs for unexpected configuration changes or CGI requests.