Security1 publisher2 min readPublished
Unauthenticated request pulls plaintext admin credentials off Digital Watchdog VMAX recorders
Every version of five Digital Watchdog VMAX recorder lines ships with a web path that returns administrator passwords in the clear. CISA says the same devices can be used to pivot onto the network behind them.
The Watch · Security desk
What happened
- CISA advisory ICSA-26-258-01 lists six CVEs against five Digital Watchdog VMAX DVR and NVR product lines, with every line marked affected at all versions.
- An unauthenticated remote attacker can make an affected recorder disclose administrator credentials in plaintext by sending crafted HTTP or HTTPS requests.
- Hard-coded credentials run the ftpd service as root, giving remote root file access to anyone who can reach FTP on the recorder.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An intruder gets live and recorded video, configuration control, and a foothold for moving onto the network behind the recorder, in the healthcare, transportation, government facility and commercial sectors CISA lists.
- constraint The credentials are baked into shipped firmware, and every earlier build carries them too, so patching is the only option available to an operator.
- capability Anyone with one device can extract the hard-coded credentials once and reuse them against every unpatched unit running the same firmware.
According to CISA, a crafted HTTP or HTTPS request makes the recorder disclose sensitive device information, administrator credentials included, in plaintext [2]. A second defect in the same advisory, filed under CWE-306, lets an attacker run as root and pass received bytes directly to a system command [3].
Two of the described weaknesses are hard-coded credentials. One allows remote access to files with root privileges where FTP is reachable [4]. The other runs the ftpd service itself as root, with the same remote root file access [5]. Both of those need FTP to be reachable; the credential-disclosure path needs only the web interface [4][5][2]. A fifth weakness leaves state-changing CGIs without authorization or session checks [6].
Six CVEs, five product lines, each line marked vers:all/*: CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887 and CVE-2026-66372, against VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, the VA1G4 Recorder and the VG4 Recorder [8][7]. That is thirty product-CVE pairs in the known_affected list [12]. Four of the five weaknesses described in the text come down to two CWEs, missing authentication for a critical function and use of hard-coded credentials [13].
Both of those are properties of the firmware as shipped. The exposure is the same on a well-run network as on a neglected one, less whatever segmentation keeps the web and FTP ports out of an attacker's reach.
CISA puts the deployment worldwide and names four sectors: Commercial Facilities, Government Services and Facilities, Healthcare and Public Health, and Transportation Systems [9]. The consequences are CISA's own wording too: full administrative control, live and recorded surveillance, altered device configurations, and use of the device as a network pivot point [1]. CISA reports no exploitation in the wild. The advisory publishes no CVSS values, no install-base estimate, and no indication of which teams operate the recorders [14].
The fix is firmware. Digital Watchdog has released updated builds, and the advisory's instruction is to download and install the firmware for your model from the vendor's downloads page [10]. Every listed model is affected at every version [15]. The instruction is per model, so each recorder needs its own download and install [16].
What to watch
- Public proof-of-concept code for the crafted HTTP(S) credential disclosure. That would move this from advisory to mass scanning.
- A published count of internet-exposed VMAX web interfaces. The advisory itself gives no figure for the exposure.
- Whether the updated firmware removes the hard-coded FTP credentials or only changes them.