CVE-2026-66890 and CVE-2026-66887 are two critical vulnerabilities in the Digital Watchdog VMAX A1 G4 DVR, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder product lines. Digital Watchdog is a well-established video surveillance (CCTV) brand, particularly in the budget/analog recorder segment, distributed in the Pacific region through Australian security distributors including CRK Security and Ness Corporation.

CVE-2026-66890 is the use of hardcoded credentials that could allow an attacker with network access to the device's FTP service to remotely access files with root privileges.

CVE-2026-66887 is a missing-authorization flaw in which state-changing CGI endpoints on the device do not perform session checks, allowing an attacker to make administrative changes without authenticating.

Affected systems are any device from the product lines below, regardless of firmware version.

Digital Watchdog VMAX A1 G4 DVR, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder - All versions (Affected)

No patched firmware has been published at the time of this advisory. Any device reachable from the same local or adjacent network segment as an attacker faces critical, confirmed risk, most acutely where the FTP service or web-management interface is exposed to an untrusted network or the internet.

No user interaction or prior authentication is required for either flaw once network access exists.

Step 1 - Reach the Device's FTP Service or Web-Management CGI Endpoints

An attacker who has reached the local or adjacent network segment a VMAX DVR/NVR sits on, for example, through a compromised device on the same LAN, an exposed FTP port, or a misconfigured network boundary, connects to the device's FTP service using the hardcoded credentials, or sends requests directly to its state-changing CGI endpoints.

Step 2 - Obtain Root-Level File Access or Make Unauthorized Administrative Changes

Using the hardcoded FTP credentials, the attacker gains root-privileged file access to the device (CVE-2026-66890); separately, because state-changing CGI endpoints do not verify a valid session, the attacker can perform administrative actions, such as altering configuration, without ever authenticating (CVE-2026-66887).

Successful exploitation may allow an attacker to gain root-privileged access to files on a device via its FTP service, and/or make unauthorized administrative changes via its web-management CGI endpoints. This can be used to access, tamper with, or delete recorded CCTV footage and device configuration, disable or reconfigure surveillance coverage, and potentially pivot from the compromised device into the wider connected network.

CERTVU recommends the following:

1. Remove Network Exposure Immediately

   Isolate every Digital Watchdog VMAX DVR/NVR device on a segmented, access-controlled network with no direct internet exposure, and disable the FTP service on the device where it is not actively required.

2. Require a VPN for Any Legitimate Remote Access

   Where remote access to a device is genuinely required, route it through a VPN rather than exposing the FTP service or web-management interface directly to the internet.

3. Monitor for a Vendor Firmware Update

   No patched firmware has been published at the time of this advisory; monitor Digital Watchdog's advisories and apply a firmware update addressing these flaws as soon as one is released.

4. Review Device and Network Access Logs

   Check device and network access logs for unexpected FTP connections or administrative changes made without a corresponding authenticated session.

Report any suspected compromise involving a Digital Watchdog VMAX DVR/NVR device to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.