Threat database

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.

CVE-2026-66887 is a critical vulnerability in the Digital Watchdog VMAX A1 G4 DVR where authorization is missing on state-changing CGI endpoints and session checks are not performed. This allows unauthorized users to perform actions that should require authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the device.

CVE-2026-68950 is a vulnerability in Digital Watchdog VMAX A1 G4 DVR devices caused by the use of hard-coded credentials. This flaw allows an attacker to run the ftpd service as root, granting remote root-level file access if FTP is reachable. The vulnerability has a high severity score of 8.8 and affects local network access scenarios.

CVE-2026-68070 is a high-severity vulnerability in Digital Watchdog VMAX A1 G4 DVR devices. The issue arises from missing authentication on a critical function, which could allow an attacker to execute commands as root by passing received bytes directly to a system command. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

CVE-2026-66890 is a critical vulnerability in Digital Watchdog VMAX A1 G4 DVR devices caused by the use of hard-coded credentials. This flaw allows remote attackers to access files with root privileges via FTP, potentially compromising the confidentiality, integrity, and availability of the affected system.

CVE-2026-68953 is an authentication bypass vulnerability in the Digital Watchdog VMAX A1 G4 DVR. It allows unauthenticated remote attackers to send crafted HTTP(S) requests to disclose sensitive device information, including administrator credentials in plaintext. The vulnerability has a medium severity with a CVSS score of 6.5. No affected versions or patch information are provided.