by Kastro
Paper/Archive/CVE-2026-66887

CVE-2026-66887

Digital Watchdog VMAX A1 G4 DVR — Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups

EPSS 0.3%CVSS 9.6
critical.is priorityof 100
34
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 25.9.259 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected products are missing authorization on state-changing CGIs and session checks are not performed.

Affected

ProductAffectedFixed inSource
VMAX A1 G4 DVRAll–CNA
VMAX IP G4 NVRAll–CNA
VMAX A1 PLUSAll–CNA
VA1G4 RecorderAll–CNA
VG4 RecorderAll–CNA

Scores by source

icscert (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdigital-watchdog.com/downloadsrefcisa.gov/news-events/ics-advisories/icsa-26-258-01refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json