Digital Watchdog VMAX DVR and NVR Product Lineups: 6 CVEs, Critical 9.6
Summary
CISA reports 6 vulnerabilities in Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder and 1 more. Weakness types: Missing Authentication for Critical Function, Use of Hard-coded Credentials, Missing Authorization (+1 more). Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. Highest CVSS v3 score: 9.6 (Critical), exploitable from an adjacent network.
At a glance
- Vendor
- Digital Watchdog
- Products
- VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder, VG4 Recorder
- CVEs
- CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372
- Highest CVSS v3
- 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Government Services and Facilities, Healthcare and Public Health, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-68953 | Missing Authentication for Critical Function | 6.5 | – | No | The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests. |
| CVE-2026-66890 | Use of Hard-coded Credentials | 9.6 | – | No | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. |
| CVE-2026-68070 | Missing Authentication for Critical Function | 8.8 | – | No | The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command. |
| CVE-2026-68950 | Use of Hard-coded Credentials | 8.8 | – | No | The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable. |
| CVE-2026-66887 | Missing Authorization | 9.6 | – | No | The affected products are missing authorization on state-changing CGIs and session checks are not performed. |
| CVE-2026-66372 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | 6.8 | – | No | The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space. |
Affected products (5)
- Digital Watchdog VMAX A1 G4 DVRs: vers:all/*
- Digital Watchdog VMAX IP G4 NVRs: vers:all/*
- Digital Watchdog VMAX A1 PLUS: vers:all/*
- Digital Watchdog VA1G4 Recorder: vers:all/*
- Digital Watchdog VG4 Recorder: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.