CVE-2026-66890 PUBLISHED

Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

Assigner: icscert
Reserved: 03.08.2026 Published: 15.09.2026 Updated: 16.09.2026

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Product Status

Vendor Digital Watchdog
Product VMAX A1 G4 DVR
Versions Default: unaffected
  • Version All is affected
Vendor Digital Watchdog
Product VMAX IP G4 NVR
Versions Default: unaffected
  • Version All is affected
Vendor Digital Watchdog
Product VMAX A1 PLUS
Versions Default: unaffected
  • Version All is affected
Vendor Digital Watchdog
Product VA1G4 Recorder
Versions Default: unaffected
  • Version All is affected
Vendor Digital Watchdog
Product VG4 Recorder
Versions Default: unaffected
  • Version All is affected

Solutions

Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:   https://digital-watchdog.com/downloads/

Credits

  • Scot Berner of TrustedSec reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-798 Use of Hard-coded Credentials CWE