Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-66887: Digital Watchdog VMAX devices allow changes without permission
CVE-2026-66887 · published 23 days ago
Summary
Several Digital Watchdog VMAX DVR and NVR models do not verify who is making changes or whether a user’s session is valid. This means an attacker who can reach the device could alter settings or recordings without being authorized. Apply any available updates from the vendor and limit network access to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| digital watchdog | vmax a1 g4 dvr | All |
| digital watchdog | vmax ip g4 nvr | All |
| digital watchdog | vmax a1 plus | All |
| digital watchdog | va1g4 recorder | All |
| digital watchdog | vg4 recorder | All |
Original advisory text
Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-862Missing Authorization
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta