CVE-2026-66887: Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
Published Sep 15, 2026
·Updated
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Event History
Sep 15, 2026
CVE Published
via MITRE·08:37 PM
Data Sourced
via MITRE·08:37 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be able to reach the affected device from an adjacent network. No privileges or user interaction are required.
2
Which deployments are most exposed?
Digital Watchdog VMAX DVR and NVR deployments reachable by an attacker on an adjacent network are exposed to the documented attack vector. The available data does not identify any affected versions or configuration prerequisites.
3
What is the potential impact of successful exploitation?
The CVSS vector rates confidentiality, integrity, and availability impact as high, with scope changed. The issue involves state-changing CGI requests being processed without authorization or session checks.