CVE-2026-68953

Digital Watchdog VMAX DVR and NVR product lineups contain a missing-authentication flaw (CWE-306) in their HTTP(S) management interface. An unauthenticated remote attacker on an adjacent network can send crafted HTTP(S) requests to bypass authentication and retrieve sensitive device information, including administrator credentials stored in plaintext. With those credentials, the attacker can log in with full administrative control of the recorder, exposing live and archived camera feeds and allowing configuration changes. The flaw is rated high severity (CVSS 4.0: 7.1, adjacent-network attack vector), consistent with devices deployed on internal or flat surveillance networks. No public proof-of-concept exists, the issue is not in the CISA KEV catalog, and no exploitation has been reported to date.

What to do: Apply the vendor's patched firmware to all VMAX DVRs and NVRs as detailed in the ICS-CERT advisory, since exact fixed versions are listed there. Until patched, remove recorders' HTTP(S) management interfaces from the internet and isolate surveillance VLANs so only trusted clients can reach them, and rotate administrator credentials that may have been exposed. Review device logs for unauthenticated requests to device-information endpoints as an indicator of probing.