CVE-2026-68953
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 4.0 | High7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| icscertCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Awaiting Analysis | 4.0 | High7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.56% · top 53% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
Digital Watchdog · VMAX A1 G4 DVR
- affected All
Digital Watchdog · VMAX IP G4 NVR
- affected All
Digital Watchdog · VMAX A1 PLUS
- affected All
Digital Watchdog · VA1G4 Recorder
- affected All
Digital Watchdog · VG4 Recorder
- affected All
What to do
Solution: Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at: https://digital-watchdog.com/downloads/
References (3)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-68953)Record last updated .