By Homeland Threat Watch News Desk

The Cybersecurity and Infrastructure Security Agency warned that six vulnerabilities affect all listed versions of five Digital Watchdog VMAX digital video recorder and network video recorder product lines. Successful exploitation could grant an attacker full administrative control of an affected device, allowing the attacker to view live and recorded surveillance, alter device configurations and use the recorder as a network pivot point, CISA said.

The affected products are VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS systems, VA1G4 Recorders and VG4 Recorders. CISA identifies every listed version of each product as known affected. The advisory covers CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887 and CVE-2026-66372.

Two of the vulnerabilities have a CVSS v3.1 score of 9.6 and are rated critical. CVE-2026-66890 involves hard-coded credentials that could allow remote access to files with root privileges where FTP is reachable. CVE-2026-66887 involves missing authorization on state-changing CGI functions, along with a lack of session checks. CISA says the two flaws could affect the confidentiality, integrity and availability of the systems.

CVE-2026-68950 is rated high, with a CVSS v3.1 score of 8.8. It also involves hard-coded credentials. The flaw could allow an attacker to run the FTP service as root, providing remote root file access where FTP is reachable.

CVE-2026-68070 is rated high at 8.8. The affected products lack authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.

The remaining vulnerabilities affect authentication and session security. CVE-2026-68953 allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, through crafted HTTP or HTTPS requests. CISA assigns that vulnerability a CVSS v3.1 score of 6.5 and rates it medium.

CVE-2026-66372 involves insufficiently random values that can make web session tokens predictable. It has a CVSS v3.1 score of 6.8 and is rated medium under CVSS v3.1. Under CVSS 4.0, CISA rates the issue high.

CISA lists the affected products as deployed worldwide. The advisory identifies commercial facilities, government services and facilities, healthcare and public health, and transportation systems among the critical infrastructure sectors associated with the product lineups. It lists the vendor’s headquarters location as the United States. Scot Berner of TrustedSec is credited with reporting the vulnerabilities to CISA.

Digital Watchdog has released updated firmware for the affected products. CISA says users should download and install the updated firmware for their model. The advisory does not provide separate fixed-version numbers for the product lines.

CISA also recommends minimizing network exposure for the recorders and ensuring that they are not accessible from the internet. Its guidance calls for placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is required, CISA recommends more secure methods such as virtual private networks and says those systems should be updated to the most current version available.

The agency also advises organizations to assess the potential effects and risks before deploying defensive measures. The recommendations are intended to reduce exposure while users address the vulnerabilities in affected Digital Watchdog VMAX DVR and NVR products.