CVE-2026-68950

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials (CWE-798) that can be used to authenticate to the device's ftpd service, which then runs as root. An attacker who can reach the FTP service can log in with these embedded credentials and gain full remote root-level file access to the recorder, including the ability to read, modify, or delete stored video and system files. The CVSS 4.0 vector (AV:A) indicates exploitation requires adjacency — typically an attacker on the same network segment — although any unit with FTP reachable from the internet would be directly exposed. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs; the advisory data does not enumerate specific firmware versions. Exploitation status is none known: there is no public PoC and the CVE is not in CISA's KEV catalog.

What to do: Disable or block the FTP service (TCP/21) on all VMAX DVRs and NVRs and restrict management/FTP access to a dedicated, isolated surveillance VLAN with an allow-list. Contact Digital Watchdog for fixed firmware and apply it as soon as an update is released, since no corrected version is identified in the advisory. Review device logs and filesystems for unexpected FTP sessions or modified/deleted video files that could indicate prior abuse of the root account.