Remote Access Vulnerability in Digital Watchdog Products via Hard-Coded Credentials
CVE-2026-66890

9.4CRITICAL

Key Information:

Vendor

Digital Watchdog

Status
Vmax A1 G4 Dvr
Vmax Ip G4 Nvr
Vmax A1 Plus
Va1g4 Recorder
Vendor
CVE Published:
15 September 2026

What is CVE-2026-66890?

Digital Watchdog products contain a vulnerability that utilizes hard-coded credentials, potentially permitting unauthorized remote access to sensitive files with root privileges. This issue arises specifically when File Transfer Protocol (FTP) services are accessible, posing significant risks to system integrity and confidentiality. Users are advised to assess their system's exposure and take necessary actions to mitigate these threats.

Affected Version(s)

VA1G4 Recorder All

VG4 Recorder All

VMAX A1 G4 DVR All

References

https://digital-watchdog.com/downloads/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scot Berner of TrustedSec reported this vulnerability to CISA.
.