Executive Summary
A second critical finding in CISA's ICS Advisory ICSA-26-258-01 covering Digital Watchdog VMAX DVR/NVR devices: CVE-2026-66890 documents hard-coded credentials built into the firmware's FTP service. Where the FTP service is network-reachable, the fixed credentials grant an attacker remote root-level file access — no valid session, password reset, or prior compromise needed. The flaw was reported to CISA by Scot Berner of TrustedSec alongside five related VMAX DVR/NVR issues, including the missing-authorization bug tracked as CVE-2026-66887.
CVSS Score: 9.6 (Critical) — CVSS v3.1; 9.4 under CVSS v4.0
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-66890 |
| CVSS v3.1 | 9.6 — AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVSS v4.0 | 9.4 |
| CWE | CWE-798 — Use of Hard-Coded Credentials |
| Type | Hard-Coded FTP Credentials with Root Privileges |
| Attack Vector | Adjacent network (requires FTP service reachability) |
| Privileges Required | None |
| Advisory | CISA ICSA-26-258-01 |
| Reported By | Scot Berner, TrustedSec |
Affected Products
| Vendor | Product Lines | Affected Versions |
|---|---|---|
| Digital Watchdog | VMAX DVR/NVR (five product lines) | All versions |
This is one of six vulnerabilities disclosed in the same advisory. A related but distinct flaw, CVE-2026-68950, also involves hard-coded credentials tied to the FTP daemon running as root on the same product family, rated slightly lower at CVSS 8.8 (High). See CVE-2026-66887 for the companion missing-authorization issue in this advisory.
Technical Details
The affected VMAX DVR/NVR firmware ships with fixed, non-changeable credentials for its FTP service. Because the credentials are identical across every device of the affected product lines and cannot be rotated by the device operator, any attacker who can reach the FTP port on a vulnerable unit can authenticate with root-equivalent privileges and access the underlying filesystem directly — bypassing the device's normal web-based access controls entirely.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Root File Access | Read/write to the device filesystem with root-equivalent privileges |
| Credential Cannot Be Rotated | Operators have no built-in way to change or disable the exposed credentials |
| Data Exfiltration | Pull recorded video, configuration files, and stored secrets off the device |
| Persistence | Root-level write access enables planting persistent malware/backdoors on the device |
CISA reports no known public exploitation at the time of publication (September 15, 2026), but flags this as one of the most severe issues in the advisory alongside CVE-2026-66887.
Remediation
Step 1: Apply the Firmware Update
Digital Watchdog has released updated firmware for the affected VMAX DVR/NVR product lines. Since the credentials are hard-coded, only a firmware update — not a configuration change — resolves the underlying issue. Contact Digital Watchdog support or your integrator for the current firmware.
Step 2: Block FTP Exposure
- Firewall the FTP port on affected devices from all networks except explicitly required management hosts.
- Disable the FTP service entirely on the device if it isn't in active use.
- Segment DVR/NVR devices onto an isolated VLAN with no route from general user or internet-facing networks.
Step 3: Assume Compromise If Exposed
If a device's FTP service has been reachable from an untrusted network, treat it as potentially compromised:
- Review the device filesystem for unexpected files or modified binaries where feasible.
- Rotate any credentials or secrets the device may have stored.
- Replace the unit if firmware remediation isn't available for the specific model.