Vulnerabilities
Digital Watchdog VMAX Devices Hit by Critical Authentication Bypass – Firmware Update Urgently Needed
All firmware versions of Digital Watchdog’s VMAX DVR and NVR lineup now suffer from a series of authentication bypass flaws that let attackers gain full administrative control, view live and recorded footage, alter settings, and even use the device as a pivot point. The CVSS score for the combined issue is 6.5 (medium). Immediate patching is required for every VMAX model in use.
Digital Watchdog’s VMAX line of digital video recorders and network video recorders is now exposed to a set of critical flaws that allow unauthenticated attackers to hijack the device. The vulnerabilities include missing authentication for critical functions, hard‑coded credentials, lack of authorization checks, and a predictable seed in a pseudo‑random number generator.
What can an attacker do?
- Gain full administrative control over the device
- View live feeds and all recorded footage
- Modify device configurations at will
- Leverage the compromised unit as a foothold for further network attacks
Which products are affected?
- VMAX A1 G4 DVRs – all firmware versions
- VMAX IP G4 NVRs – all firmware versions
- VMAX A1 PLUS – all firmware versions
- VA1G4 Recorder – all firmware versions
- VG4 Recorder – all firmware versions
Vulnerabilities & CVEs
- CVE-2026-68953
- CVE-2026-66890
- CVE-2026-68070
- CVE-2026-68950
- CVE-2026-66887
- CVE-2026-66372
The combined CVSS 3.1 score for these issues is 6.5, classified as medium severity. However, the impact is far higher for critical infrastructure sectors such as commercial facilities, government services, healthcare, and transportation.
Mitigation
Digital Watchdog has released firmware updates that address all of the listed vulnerabilities. Users should download and install the latest firmware for their specific model as soon as possible.
“Users should download and install the updated firmware for their model at the Digital Watchdog website.”
Failure to patch could leave facilities exposed to full device takeover and potential lateral movement within the network.
Related vulnerabilities
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Critical PAN-OS Buffer Overflow (CVE‑2026‑0300) Enables Root‑Level Code Execution
Palo Alto Networks has disclosed a 9.3‑scored buffer overflow in the User‑ID Authentication Portal of PAN‑OS that lets an unauthenticated attacker run arbitrary code with root privileges on PA‑Series and VM‑Series firewalls. Affected firmware spans versions before 12.1.4‑h5, 12.1.7, 11.2.4‑h17, and several earlier releases. No patch is live yet, but Palo Alto will ship one soon. Until then, limit or disable the captive portal. Immediate update is urged to shut the door on this critical flaw.
Read briefing
Siemens Teamcenter XSS Vulnerability (CVE‑2026‑58113) Could Let Attackers Hijack Authenticated Sessions
A reflected cross‑site scripting flaw in Siemens Teamcenter’s authentication redirect flow allows an unauthenticated attacker to inject JavaScript into an authenticated user’s browser by crafting a malicious URL. Successful exploitation can let the attacker read data or perform actions within the victim’s Teamcenter session. Siemens has issued patches for all affected releases; administrators should update immediately.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing