EUVD-2026-79950
GHSA-vrh9-rxg2-c33f
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack arrives over the adjacent network via a reachable FTP service with static credentials, so PR:N and AC:L; root file access yields full C/I/A.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.
AnalysisAI
Hard-coded credentials in the FTP daemon (ftpd) shipped with multiple Digital Watchdog video recorders and NVRs-including VG4 Recorder, VMAX IP G4 NVR, VMAX A1 PLUS, VA1G4 Recorder, and VMAX A1 G4 DVR-let anyone who can reach the FTP service log in and operate the daemon as root. Because the ftpd runs as root, a successful login grants remote read and write access to the device filesystem, allowing an attacker to tamper with recorded surveillance video, alter device configuration, or use the box as a foothold on the camera VLAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the ftpd service be enabled and reachable on the recorder (it is the same service that provides remote FTP file access), and that the attacker have network adjacency to the device-the CVSS 4.0 vector is AV:A, so L2/L3 reachability to the FTP port on the camera/NVR VLAN, a shared management network, or a wireless segment bridged into that VLAN is sufficient; there is no internet-facing requirement unless a deployment has forwarded port 21 to the recorder. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes a low-complexity, unauthenticated attack from the adjacent network with full confidentiality, integrity, and availability impact on the device itself, and the No-Privileges/no-Interaction combination means no phishing or valid account is needed-only L2/L3 reachability to the recorder, which is common on flat camera or building-management VLANs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the immediate action is containment rather than upgrade: disable the FTP/ftpd service on every affected recorder and NVR through the device administration interface, and block TCP port 21 (and any non-standard FTP control/data ports the device exposes) at the VLAN boundary and on the host firewall. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today