CVE-2026-66890

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials baked into the firmware, in violation of secure development practice (CWE-798). When the device's FTP service is reachable, a remote attacker can authenticate using these embedded credentials and access files with root privileges, potentially reading or modifying arbitrary files on the recorder, including stored video footage and configuration data. The CVSS 4.0 base score is 9.4 (critical), though the adjacent-network attack vector means the attacker generally needs access to the same network segment as the recorder. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs, which are commonly deployed in commercial video surveillance environments such as retail, banking, and education. There is no known public proof-of-concept and no evidence of in-the-wild exploitation to date.

What to do: Apply vendor firmware updates to affected VMAX DVRs/NVRs as soon as Digital Watchdog releases them, and check the ICS-CERT advisory for the exact model and firmware list. Immediately disable the FTP service if it is not required, and restrict management protocols on recorders to a dedicated VLAN or firewall allowlist so only trusted clients can reach them. Audit FTP access logs for unauthorized logins and rotate any local credentials as a precaution.