CVE-2026-66890: Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Digital Watchdog VMAX DVR and NVR products are exposed where their FTP service is reachable remotely. The available information does not identify affected versions or distinguish between specific models.
What access does an attacker need to exploit this issue?
An attacker does not need prior privileges or user interaction. They need network access to a reachable FTP service on an affected product.
What could an attacker gain through exploitation?
The hard-coded credentials could allow remote access to files with root privileges. This can affect confidentiality, integrity, and availability.
What can be done while a vendor fix is being evaluated or deployed?
Limit FTP reachability to trusted administrative networks and prevent untrusted remote access to the service. The provided information does not specify a patch, workaround, or configuration setting that removes the hard-coded credentials.