Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.

Digital Watchdog VMAX DVRs and NVRs are missing authorization checks on state-changing CGI endpoints and perform no session validation, so requests that modify device state can be accepted without a valid authenticated session (CWE-862). An attacker who can reach the recorder on the same network segment (CVSS attack vector is adjacent-network, with no privileges or user interaction required) can invoke these CGIs directly and change device configuration or behavior, with critical-rated impacts on the confidentiality, integrity, and availability of the recorder and dependent systems such as recorded video and surveillance operations. Organizations running VMAX DVR/NVR appliances — typically commercial and physical-security video deployments — are affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild, though exposed recorder web interfaces are routine targets once network access is obtained.

Do: Apply the vendor firmware update for the VMAX DVR/NVR lineups as described in the ICS-CERT advisory and confirm the patched build is running. Because exploitation requires adjacent-network access, place recorders on a dedicated VLAN or behind firewall rules so only trusted clients can reach their CGI/web endpoints. Rotate any default credentials and review device logs for unexpected configuration changes or CGI requests.

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials baked into the firmware, in violation of secure development practice (CWE-798). When the device's FTP service is reachable, a remote attacker can authenticate using these embedded credentials and access files with root privileges, potentially reading or modifying arbitrary files on the recorder, including stored video footage and configuration data. The CVSS 4.0 base score is 9.4 (critical), though the adjacent-network attack vector means the attacker generally needs access to the same network segment as the recorder. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs, which are commonly deployed in commercial video surveillance environments such as retail, banking, and education. There is no known public proof-of-concept and no evidence of in-the-wild exploitation to date.

Do: Apply vendor firmware updates to affected VMAX DVRs/NVRs as soon as Digital Watchdog releases them, and check the ICS-CERT advisory for the exact model and firmware list. Immediately disable the FTP service if it is not required, and restrict management protocols on recorders to a dedicated VLAN or firewall allowlist so only trusted clients can reach them. Audit FTP access logs for unauthorized logins and rotate any local credentials as a precaution.

CVE-2026-68070 is a missing-authentication flaw (CWE-306) in Digital Watchdog's VMAX DVR and NVR video recorder lineups, in which a critical, network-reachable function passes attacker-supplied bytes directly to a system command executed with root privileges. An unauthenticated attacker on an adjacent network (per the CVSS 4.0 attack vector AV:A) can trigger the flaw by sending crafted requests to the vulnerable service on the recorder, without needing credentials or user interaction. Successful exploitation yields full root command execution on the device, allowing the attacker to take complete control of the recorder, its stored video, and any cameras or credentials it manages, and to use the device as a foothold on the surveillance network. The affected products are the Digital Watchdog VMAX DVR and NVR product lineups; the CVE data does not enumerate specific firmware versions, so defenders should consult the ICS-CERT advisory for the exact affected version ranges. Exploitation status is none known: the flaw is not in the CISA KEV catalog and no public proof-of-concept has been published.

Do: Apply Digital Watchdog firmware updates for VMAX DVRs and NVRs as specified in the ICS-CERT advisory, since affected version ranges are enumerated there. Until patched, isolate surveillance gear on a restricted VLAN and block all untrusted or guest network access to the recorders' management services via firewall rules, as the flaw requires adjacent-network access. Check recorders for signs of compromise, such as unknown accounts, unexpected outbound connections, or modified configuration, and rotate any credentials stored on the devices.

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials (CWE-798) that can be used to authenticate to the device's ftpd service, which then runs as root. An attacker who can reach the FTP service can log in with these embedded credentials and gain full remote root-level file access to the recorder, including the ability to read, modify, or delete stored video and system files. The CVSS 4.0 vector (AV:A) indicates exploitation requires adjacency — typically an attacker on the same network segment — although any unit with FTP reachable from the internet would be directly exposed. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs; the advisory data does not enumerate specific firmware versions. Exploitation status is none known: there is no public PoC and the CVE is not in CISA's KEV catalog.

Do: Disable or block the FTP service (TCP/21) on all VMAX DVRs and NVRs and restrict management/FTP access to a dedicated, isolated surveillance VLAN with an allow-list. Contact Digital Watchdog for fixed firmware and apply it as soon as an update is released, since no corrected version is identified in the advisory. Review device logs and filesystems for unexpected FTP sessions or modified/deleted video files that could indicate prior abuse of the root account.

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.