Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-66890: Digital Watchdog VMAX devices expose files through default passwords
CVE-2026-66890 · published 23 days ago
Summary
Several Digital Watchdog VMAX video recorders and network video recorders come with built‑in usernames and passwords. If the FTP service is left enabled, an attacker could log in with those defaults and view or download any stored video files. Change the default accounts, disable or restrict FTP access, and apply any available firmware updates to protect the system.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| digital watchdog | vmax a1 g4 dvr | All |
| digital watchdog | vmax ip g4 nvr | All |
| digital watchdog | vmax a1 plus | All |
| digital watchdog | va1g4 recorder | All |
| digital watchdog | vg4 recorder | All |
Original advisory text
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta