Digital Watchdog VMAX: the recorder is a computer, and CISA just listed the passwords

CISA's midweek ICS note on Digital Watchdog did not make the weekend KEV list. It still belongs on a Sunday site-security page. Advisory ICSA-26-258-01, dated September 15. Six bugs across the VMAX DVR and NVR lines. Successful use, CISA says, is full admin on the recorder: live and recorded video, config changes, and a pivot into the rest of the LAN. No known public exploitation in that advisory. Adjacent network, not "anyone on the internet." If the NVR sits on the office VLAN because that was easier than a camera switch, the distinction is a drawing, not a control.

What is in scope

Every firmware build CISA listed is "all versions" on these lines: VMAX A1 G4 DVR, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, VG4 Recorder. The CVEs are CVE-2026-68953 (auth bypass that can spill admin credentials in plaintext over HTTP), CVE-2026-66890 and CVE-2026-68950 (hard-coded FTP credentials, root file access where FTP is reachable), CVE-2026-68070 (unauthenticated root command path), CVE-2026-66887 (state-changing CGIs with no session check), and CVE-2026-66372 (predictable web session tokens). We are not going to decorate those sentences. The vendor posted firmware on digital-watchdog.com/downloads. Scot Berner at TrustedSec reported the set to CISA.

CVSS on the worst of them is 9.6 with an adjacent-network vector. That is a yard or a shop VLAN, a contractor trailer, a shared switch behind the office Wi-Fi. It is the same class of finding we already write on a site walk: the box that holds the evidence is itself a computer, and it often has a password that never left the factory.

What this means for a contractor yard

Alberta yards are being offered solar trailers and month-to-month monitored response. That can be the right next step after you know what you need. It does not fix a recorder that still answers FTP as root on the same LAN as payroll. Flock last week was a key left on the device. Tapo was a same-LAN bypass. This is the DVR version. An insurer who asks for footage will also, sooner or later, ask whether the NVR was the hole.

CISA's usual ICS advice still applies: do not put the recorder on the internet, put it behind a firewall, use a VPN if someone must reach it, and remember a VPN is only as honest as the box it lands on. Firmware first. Then take FTP off the LAN. Then write down retention and export so an adjuster gets a hash and a cover note, not a login to a box you just patched.

What we would check this week

• Inventory recorders by model, not by "the cameras work." If the label says VMAX or VG4, pull the vendor firmware for that exact model and confirm the build after the update.
• FTP closed. Management UI not on a guest SSID. No inbound port-forward "so the owner can watch from the lake."
• If the NVR has ever been on a shared office network, treat adjacent-network as already true. Review what else lives on that VLAN.
• Evidence package: timestamps that match, retention you can defend, export you can hand over. A patched recorder with no export plan is still a coverage gap.

Bottom line

A recorder with a factory FTP password is not a camera problem. It is a computer on your LAN that happens to hold the footage. Forensic Five walks the yard and reviews the system that watches it. From St. Albert, Alberta. Install the firmware. Then take the recorder off the office switch.