3 dispatches · latest 16 SEP 2026 · all keywords →
Your cameras can't phone home or leak creds to the internet, and only your NVR can reach them — with four firewall rules on OPNsense (or UniFi) that take an afternoon. Verified against current docs, 2026-09-16.
CISA advisory ICSA-26-258-08 covers seven CVEs in the CareCam CM2507 IP camera (firmware v251211.1507). Headlined by unauthenticated live video over the network — and no fix exists, because CareCam hasn't answered CISA's coordination attempts.
CISA advisory ICSA-26-258-01 covers six CVEs across the entire Digital Watchdog VMAX DVR/NVR line — all versions affected. An unauthenticated request can hand over your admin credentials in plaintext, and a hard-coded credential scores 9.6.