CVE-2026-68953
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 15, 2026
- Updated
- Sep 16, 2026
- Reserved
- Aug 3, 2026
Description
The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-306 Missing authentication for critical function
Affected Products
| Product | Versions |
|---|---|
VMAX A1 G4 DVRDigital Watchdog |
|
VMAX IP G4 NVRDigital Watchdog |
|
VMAX A1 PLUSDigital Watchdog |
|
VA1G4 RecorderDigital Watchdog |
|
VG4 RecorderDigital Watchdog |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.