Digital Watchdog VMAX DVR and NVR Product Lineups

CISA has published an ICS advisory (ICSA-26-258-01) disclosing six vulnerabilities affecting Digital Watchdog VMAX DVR and NVR product lineups, including VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder (all versions). The vulnerabilities include authentication bypass (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), missing authentication for critical functions allowing root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable PRNG seeds leading to guessable session tokens (CVE-2026-66372). The highest CVSS v3.1 score is 9.6 (CRITICAL). Successful exploitation could grant full administrative control, allow viewing of live and recorded surveillance, alter configurations, and use devices as network pivot points. Affected sectors include Commercial Facilities, Government Services, Healthcare, and Transportation. Digital Watchdog has released updated firmware as mitigation. No known active public exploitation has been reported at this time.