CVE-2026-66887— Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
Quick assessment
Affected
Digital Watchdog VMAX A1 G4 DVR
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
受影响的产品在状态更改的 CGI 脚本上缺少授权控制，且未执行会话验证。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1210 · Exploitation of Remote Services T1563.001 · SSH Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66887
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
Source: CVE Program / CVE List V5
Vulnerability Description
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Digital Watchdog | VMAX A1 G4 DVR | All | - |
|
| Digital Watchdog | VMAX IP G4 NVR | All | - |
|
| Digital Watchdog | VMAX A1 PLUS | All | - |
|
| Digital Watchdog | VA1G4 Recorder | All | - |
|
| Digital Watchdog | VG4 Recorder | All | - |
|
II. Public POCs for CVE-2026-66887
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66887
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66887 (2)
Other References for CVE-2026-66887 (1)
Same Patch Batch · Digital Watchdog · 2026-09-15 · 6 CVEs total
| CVE-2026-66890 | 9.6 CRITICAL | Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups |
| CVE-2026-68070 | 8.8 HIGH | Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product |
| CVE-2026-68950 | 8.8 HIGH | Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups |
| CVE-2026-66372 | 6.8 MEDIUM | Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and |
| CVE-2026-68953 | 6.5 MEDIUM | Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product |
IV. Related Vulnerabilities
Same product: VMAX A1 G4 DVR
-
CVE-2026-66372
Predictable Seed in Pseudo-Random Number Generator (PRNG) in -
CVE-2026-68950
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR a -
CVE-2026-68070
Missing Authentication for Critical Function in Digital Watc -
CVE-2026-66890
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR a -
CVE-2026-68953
Missing Authentication for Critical Function in Digital Watc
Same vendor: Digital Watchdog
-
CVE-2026-66372
Predictable Seed in Pseudo-Random Number Generator (PRNG) in -
CVE-2026-68950
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR a -
CVE-2026-68070
Missing Authentication for Critical Function in Digital Watc -
CVE-2026-66890
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR a -
CVE-2026-68953
Missing Authentication for Critical Function in Digital Watc
V. Comments for CVE-2026-66887
No comments yet