by Kastro
Paper/Archive/CVE-2026-66890

CVE-2026-66890

Digital Watchdog VMAX A1 G4 DVR — Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

EPSS 0.3%CVSS 9.6
critical.is priorityof 100
34
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 25.9.259 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

Affected

ProductAffectedFixed inSource
VMAX A1 G4 DVRAll–CNA
VMAX IP G4 NVRAll–CNA
VMAX A1 PLUSAll–CNA
VA1G4 RecorderAll–CNA
VG4 RecorderAll–CNA

Scores by source

icscert (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdigital-watchdog.com/downloadsrefcisa.gov/news-events/ics-advisories/icsa-26-258-01refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json