Skip to content
OpenAdvisories
Critical ICSA-26-258-01 6 CVEs

Digital Watchdog VMAX DVR and NVR Product Lineups

Published Sep 15, 2026 · Updated Sep 15, 2026

Vendor: Digital Watchdog Product: VA1G4 Recorder Product: VG4 Recorder Product: VMAX A1 G4 DVRs Product: VMAX A1 PLUS Product: VMAX IP G4 NVRs

Summary

Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point.

Vulnerabilities 6

  • Critical 9.6
    CVE-2026-66887

    Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products are missing authorization on state-changing CGIs and session checks are not performed.

    Digital Watchdog VG4 Recorder VMAX IP G4 NVR VA1G4 Recorder
  • Critical 9.6
    CVE-2026-66890

    Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

    Digital Watchdog VMAX A1 G4 DVR VMAX A1 PLUS VG4 Recorder
  • High 8.8
    CVE-2026-68070

    Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.

    Digital Watchdog VMAX IP G4 NVR VA1G4 Recorder VMAX A1 G4 DVR
  • High 8.8
    CVE-2026-68950

    Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.

    Digital Watchdog VMAX IP G4 NVR VA1G4 Recorder VMAX A1 G4 DVR
  • Medium 6.8
    CVE-2026-66372

    Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.

    Digital Watchdog VMAX IP G4 NVR VA1G4 Recorder VMAX A1 G4 DVR
  • Medium 6.5
    CVE-2026-68953

    Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

    The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.

    Digital Watchdog VMAX A1 G4 DVR VMAX A1 PLUS VG4 Recorder

Revision history

  1. #1

    Initial Publication

References