CISA has warned that six vulnerabilities affect all listed versions of Digital Watchdog’s VMAX DVR and NVR product lineups. Successful exploitation could give an attacker full administrative control of a recorder, enabling access to live and recorded surveillance, changes to device configurations, and use of the device as a network pivot point, according to CISA’s advisory.

The affected products are VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS systems, VA1G4 Recorders and VG4 Recorders. CISA lists every version of each product family as affected by CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887 and CVE-2026-66372. The advisory identifies deployments worldwide and names commercial facilities, government services and facilities, healthcare and public health, and transportation systems among the affected critical infrastructure sectors.

The highest-rated issues include a hard-coded-credential flaw and a missing-authorization flaw, each assigned a CVSS version 3.1 score of 9.6, in the critical range. CVE-2026-66890 could permit remote access to files with root privileges when FTP is reachable. CVE-2026-68950 similarly involves hard-coded credentials and could allow an attacker to run an FTP service as root, providing remote root file access. Both vulnerabilities affect all five product families.

CVE-2026-68070 involves a critical function that lacks authentication. CISA says exploitation could allow an attacker to run as root and pass received bytes directly to a system command. The issue has a CVSS version 3.1 score of 8.8.

CVE-2026-68953 describes an authentication bypass that can be triggered by crafted HTTP or HTTPS requests without authentication. The flaw could allow disclosure of sensitive device information, including administrator credentials in plaintext. CISA assigns the vulnerability a CVSS version 3.1 score of 6.5.

The remaining flaws affect authorization and session security. CVE-2026-66887 involves missing authorization on state-changing CGI functions, along with a lack of session checks. CISA gives that vulnerability a CVSS version 3.1 score of 9.6. CVE-2026-66372 involves insufficiently random values that can make web session tokens predictable by limiting their entropy to the size of the underlying seed space. CISA assigns it a CVSS version 3.1 score of 6.8.

Digital Watchdog has released updated firmware for the affected products. CISA recommends that users install the updated firmware for their specific model. The advisory also recommends reducing network exposure for control-system devices and preventing direct Internet access. Its guidance calls for placing control-system networks and remote devices behind firewalls and isolating them from business networks.

Where remote access is necessary, CISA recommends more secure methods such as virtual private networks and advises organizations to keep those systems updated. The agency also notes that a VPN’s security depends on the connected devices. Organizations are advised to conduct impact analysis and risk assessment before deploying defensive changes.

The vulnerabilities were reported to CISA by Scot Berner of TrustedSec. CISA’s advisory lists the affected product families as known affected and describes potential impacts that include administrative control, surveillance access, configuration changes and network pivoting.