Digital Watchdog VMAX DVR and NVR Product Lineups
CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.
CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.
- Six CVEs affect all Digital Watchdog VMAX DVR/NVR lineups, aggregate CVSS 9.6
- Authentication bypass leaks plaintext administrator credentials via crafted HTTP(S) requests
- Hard-coded credentials and root command execution enable full device takeover
- Compromised recorders expose surveillance feeds and serve as network pivots
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-66890+1 related CVE | Hard-Coded FTP Credentials Give Root File Access in Digital Watchdog VMAX DVRs/NVRs | 9.4 group max | — | ||
CVE-2026-66887+3 related CVEs | Unauthenticated State-Changing CGI Access in Digital Watchdog VMAX DVR/NVR | 9.4 group max | — |
From the original article
5 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.