The Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on September 15 detailing six vulnerabilities in Digital Watchdog’s VMAX A1 G4 and VMAX IP G4 digital and network video recorder lineups, including its VA1G4 and VG4 recorder models. According to CISA, successful exploitation could grant an attacker full administrative control of an affected device, enabling access to live and recorded surveillance footage, alteration of device configurations, and use of the recorder as a pivot point into a broader network.
Two of the flaws, tracked as CVE-2026-66890 and CVE-2026-66887, received a CVSS v3.1 severity score of 9.6 out of 10, in the critical range. CISA said the issues include missing authentication for critical functions, use of hard-coded credentials, missing authorization checks on state-changing requests, and a predictable random-number generator used to create session tokens. The vulnerabilities were reported to CISA by researcher Scot Berner of TrustedSec.
Digital Watchdog products are deployed worldwide across commercial facilities, government buildings, healthcare and transportation sites, according to CISA’s sector tagging. The company has released updated firmware addressing the vulnerabilities, available through its website, CISA said. The agency recommends isolating control system devices from the internet and placing them behind firewalls, and noted that no public exploitation of the flaws has been reported to date.
Why it matters
Recorders sit at the center of a facility’s video evidence chain; a fully compromised DVR/NVR can expose live and archived footage and serve as a foothold into the wider network. Operators running affected VMAX models should prioritize the firmware update and confirm the devices are not internet-exposed.
Leave a Reply