Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by Digital Watchdog
CVE-2026-68953 (GCVE-0-2026-68953)
Vulnerability from nvd – Published: 2026-09-15 20:20 – Updated: 2026-09-15 20:20
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests."
}
],
"value": "The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:20:57.887Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68953",
"datePublished": "2026-09-15T20:20:57.887Z",
"dateReserved": "2026-08-03T21:27:04.638Z",
"dateUpdated": "2026-09-15T20:20:57.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68950 (GCVE-0-2026-68950)
Vulnerability from nvd – Published: 2026-09-15 20:31 – Updated: 2026-09-15 20:31
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.
Severity
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable."
}
],
"value": "The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:31:56.303Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68950",
"datePublished": "2026-09-15T20:31:56.303Z",
"dateReserved": "2026-08-03T21:27:04.643Z",
"dateUpdated": "2026-09-15T20:31:56.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68070 (GCVE-0-2026-68070)
Vulnerability from nvd – Published: 2026-09-15 20:28 – Updated: 2026-09-15 20:28
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command."
}
],
"value": "The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:28:27.109Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68070",
"datePublished": "2026-09-15T20:28:27.109Z",
"dateReserved": "2026-08-03T21:27:04.634Z",
"dateUpdated": "2026-09-15T20:28:27.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66890 (GCVE-0-2026-66890)
Vulnerability from nvd – Published: 2026-09-15 20:25 – Updated: 2026-09-15 20:25
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
Severity
9.6 (Critical)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable."
}
],
"value": "The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:25:09.383Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66890",
"datePublished": "2026-09-15T20:25:09.383Z",
"dateReserved": "2026-08-03T21:27:04.646Z",
"dateUpdated": "2026-09-15T20:25:09.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66887 (GCVE-0-2026-66887)
Vulnerability from nvd – Published: 2026-09-15 20:37 – Updated: 2026-09-15 20:37
VLAI
EPSS
VEX
Title
Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Severity
9.6 (Critical)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are missing authorization on state-changing CGIs and session checks are not performed."
}
],
"value": "The affected products are missing authorization on state-changing CGIs and session checks are not performed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:37:51.407Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp; \u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66887",
"datePublished": "2026-09-15T20:37:51.407Z",
"dateReserved": "2026-08-03T21:27:04.605Z",
"dateUpdated": "2026-09-15T20:37:51.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66372 (GCVE-0-2026-66372)
Vulnerability from nvd – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Title
Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.
Severity
CWE
- CWE-337 - Predictable seed in Pseudo-Random number generator (PRNG)
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space."
}
],
"value": "The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-337",
"description": "CWE-337 Predictable seed in Pseudo-Random number generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:19.724Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\n https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66372",
"datePublished": "2026-09-15T20:41:19.724Z",
"dateReserved": "2026-08-03T21:27:04.641Z",
"dateUpdated": "2026-09-15T20:41:19.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66372 (GCVE-0-2026-66372)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Title
Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.
Severity
CWE
- CWE-337 - Predictable seed in Pseudo-Random number generator (PRNG)
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space."
}
],
"value": "The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-337",
"description": "CWE-337 Predictable seed in Pseudo-Random number generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:19.724Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\n https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66372",
"datePublished": "2026-09-15T20:41:19.724Z",
"dateReserved": "2026-08-03T21:27:04.641Z",
"dateUpdated": "2026-09-15T20:41:19.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66887 (GCVE-0-2026-66887)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:37 – Updated: 2026-09-15 20:37
VLAI
EPSS
VEX
Title
Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Severity
9.6 (Critical)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are missing authorization on state-changing CGIs and session checks are not performed."
}
],
"value": "The affected products are missing authorization on state-changing CGIs and session checks are not performed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:37:51.407Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp; \u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66887",
"datePublished": "2026-09-15T20:37:51.407Z",
"dateReserved": "2026-08-03T21:27:04.605Z",
"dateUpdated": "2026-09-15T20:37:51.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68950 (GCVE-0-2026-68950)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:31 – Updated: 2026-09-15 20:31
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.
Severity
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable."
}
],
"value": "The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:31:56.303Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68950",
"datePublished": "2026-09-15T20:31:56.303Z",
"dateReserved": "2026-08-03T21:27:04.643Z",
"dateUpdated": "2026-09-15T20:31:56.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68070 (GCVE-0-2026-68070)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:28 – Updated: 2026-09-15 20:28
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command."
}
],
"value": "The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:28:27.109Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68070",
"datePublished": "2026-09-15T20:28:27.109Z",
"dateReserved": "2026-08-03T21:27:04.634Z",
"dateUpdated": "2026-09-15T20:28:27.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66890 (GCVE-0-2026-66890)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:25 – Updated: 2026-09-15 20:25
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
Severity
9.6 (Critical)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable."
}
],
"value": "The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:25:09.383Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-66890",
"datePublished": "2026-09-15T20:25:09.383Z",
"dateReserved": "2026-08-03T21:27:04.646Z",
"dateUpdated": "2026-09-15T20:25:09.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68953 (GCVE-0-2026-68953)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:20 – Updated: 2026-09-15 20:20
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
Summary
The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR |
Affected:
All
|
|
| Digital Watchdog | VMAX IP G4 NVR |
Affected:
All
|
|
| Digital Watchdog | VMAX A1 PLUS |
Affected:
All
|
|
| Digital Watchdog | VA1G4 Recorder |
Affected:
All
|
|
| Digital Watchdog | VG4 Recorder |
Affected:
All
|
Date Public
2026-09-15 18:28
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMAX A1 G4 DVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX IP G4 NVR",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VMAX A1 PLUS",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VA1G4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VG4 Recorder",
"vendor": "Digital Watchdog",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Scot Berner of TrustedSec reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-15T18:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests."
}
],
"value": "The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:20:57.887Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://digital-watchdog.com/downloads/"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u0026nbsp;\u0026nbsp;\u003ca href=\"https://digital-watchdog.com/downloads/\"\u003ehttps://digital-watchdog.com/downloads/\u003c/a\u003e"
}
],
"value": "Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at:\u00a0\u00a0 https://digital-watchdog.com/downloads/"
}
],
"source": {
"advisory": "ICSA-26-258-01",
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-68953",
"datePublished": "2026-09-15T20:20:57.887Z",
"dateReserved": "2026-08-03T21:27:04.638Z",
"dateUpdated": "2026-09-15T20:20:57.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}