Digital Watchdog VMAX Hit by Six Chained Auth Flaws

Six vulnerabilities in the same product family, all exploitable from an adjacent network, all shipping in every firmware version. That's the shape of CISA's advisory on Digital Watchdog VMAX DVRs and NVRs, and it's worth sitting with the chain before filing it as just another ICS advisory.

The entry point is CVE-2026-68953: an authentication bypass that lets an unauthenticated attacker extract administrator credentials in plaintext via crafted HTTP(S) requests. From there, hard-coded credentials (CVE-2026-66890) grant remote root file access where FTP is reachable. A second hard-coded credential (CVE-2026-68950) runs the FTP daemon as root for the same effect through a different path. Meanwhile, CVE-2026-66887 (missing authorization on state-changing CGIs with no session checks) and CVE-2026-68070, which passes received bytes directly to a system command as root, both operate without authentication. The closer: CVE-2026-66372, a predictable PRNG seed that makes web session tokens guessable.

The advisory doesn't rank them this way, but the practical takeaway is that an attacker on the same LAN (or anyone who reaches the device through whatever network path FTP and HTTP(S) traverse) can move from discovery to root in a few steps without ever hitting a credential prompt they can't bypass.

What the advisory doesn't say

The affected products (VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder) are deployed worldwide across Commercial Facilities, Government Services and Facilities, Healthcare and Public Health, and Transportation Systems. CISA's advisory says Digital Watchdog has released updated firmware and directs users to the vendor's download page. It doesn't provide interim mitigations for deployments where firmware updates can't be applied immediately, nor does it address whether the FTP service can be disabled as a stopgap on models where it isn't operationally required.

That gap matters. Surveillance recorders in operational facilities don't always live on update schedules that track ICS advisory publication dates. An NVR in a municipal transit hub or a hospital security office may sit air-gapped or on a segmented network where the patch cycle is measured in weeks, not days. The absence of compensating control guidance puts the burden on the facility operator to reverse-engineer the vulnerability chain and decide what to shut off.

Not the first rodeo

CISA has now published multiple ICS advisories on surveillance infrastructure with overlapping vulnerability classes. The Honeywell MAXPRO advisory from early 2020 covered deserialization and SQL injection flaws with the same 9.8 severity neighborhood. The Hitron DVR advisory in January 2024 documented improper input validation and default credentials across six DVR models. Hikvision NVR and DVR vulnerabilities have appeared in CISA advisories and NVD records through 2025, spanning buffer overflows and improper authentication on serial ports.

The pattern isn't subtle: network-connected surveillance appliances, built by vendors whose core competency is video, shipping with authentication models that wouldn't pass review in any other networked device category. The affected sectors (healthcare, transportation, government, commercial facilities) are the same ones that appear on the CISA advisory boilerplate because they're the ones actually buying and deploying this equipment at scale.

TrustedSec researcher Scot Berner reported these six vulnerabilities to CISA. The advisory doesn't indicate whether any of them are under active exploitation, but the chained nature of the flaws and the worldwide deployment footprint make this one to patch before that question answers itself.