Your NVR's Admin Password, In Plaintext, To Anyone Who Can Reach It (Digital Watchdog VMAX)

What this advisory is//

CISA published ICSA-26-258-01 on September 15, 2026 — an ICS advisory about a product line most of us bought off Amazon for driveway and garage cams: the Digital Watchdog VMAX DVRs and NVRs. The affected list is not "certain firmwares" — it's vers:all/* on all five lines in scope:

• VMAX A1 G4 DVRs
• VMAX IP G4 NVRs
• VMAX A1 PLUS
• VA1G4 Recorder
• VG4 Recorder

If you own one of these, every version is affected. Reported by Scot Berner of TrustedSec, no known public exploitation to date, and not in KEV yet — but "all versions" on a consumer NVR line means the exposure window has been open for as long as anyone's owned one of these boxes.

What actually broke//

Six CVEs, top score CVSS v3 9.6. The headline flaw is the one that makes this post: CVE-2026-68953 — an authentication bypass where an unauthenticated remote attacker discloses sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests. No login page to brute-force, no default creds to guess: the box tells you your admin password if you know which door to knock on.

The 9.6 belongs to a different bug — worth keeping straight so nobody flattens the scores: CVE-2026-66890, hard-coded credentials that give remote root file access where FTP is reachable, and it doesn't hold the top score alone: CVE-2026-66887 (missing authorization on state-changing CGIs, no session checks) also scores 9.6. The full roster:

CVE	What it is	CVSS v3.1
CVE-2026-68953	Unauth disclosure of device info incl. plaintext admin creds (CWE-306)	6.5
CVE-2026-66890	Hard-coded credentials → root file access via reachable FTP (CWE-798)	9.6
CVE-2026-68070	Missing auth for a critical function: run as root, feed received bytes straight to a system command (CWE-306)	8.8
CVE-2026-68950	Hard-coded credentials → run the FTP daemon as root, remote file access where FTP is reachable (CWE-798)	8.8
CVE-2026-66887	Missing authorization on state-changing CGIs + no session checks (CWE-862)	9.6
CVE-2026-66372	Predictable PRNG seed → predictable web session tokens (CWE-337)	6.8

Read that list as a sentence: the authentication layer is decorative, the credentials are baked into the firmware, and even your session token is guessable. Successful exploitation, per CISA's own summary, "could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point."

Why "all versions" matters more than the scores//

The scores tell you how bad it is if someone reaches the box. The product table tells you who has the box: every version of five product lines, deployed worldwide, sold into Commercial Facilities, Government, Healthcare, and Transportation sectors — plus everyone who bought a VMAX on Amazon because it was cheap and had PoE ports. A NVR that's "all versions affected" is a NVR nobody can point at a changelog and say "I'm past the bad one."

The fix (it exists — check your exact model)//

Unlike yesterday's CareCam story, this one has a remediation: Digital Watchdog released updated firmware for the affected products, per the advisory. You download it from digital-watchdog.com/downloads/ for your model. One honest caveat: the advisory doesn't state which of the six CVEs that firmware actually addresses — so if your exact unit isn't on the downloads page, or the changelog is vague, treat "fixed" as unverified until you've read it.

What to do tonight//

1. Inventory — if you own a VMAX A1 G4, VMAX IP G4, A1 PLUS, VA1G4, or VG4 (or bought one for a neighbor), it's in scope. All versions.
2. Check your exact model at digital-watchdog.com/downloads/ — flash the updated firmware if it's listed; read the changelog to see which CVEs it claims to fix.
3. Kill remote management on the NVR unless you're actively using it, and never on default credentials.
4. Segment or firewall: put the NVR on its own VLAN with rules that allow only what your cameras and Frigate actually need — the full rule set is in this week's tutorial.
5. If it was internet-facing, rotate credentials after patching — treat the admin password as burned, because CVE-2026-68953 made it readable by anyone who knew to ask.
6. Watch ICSA-26-258-01 for an Update A — and keep an eye on KEV; "no known public exploitation" is a snapshot, not a promise.