EUVD-2026-79944

| CVE-2026-68953 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-09-15 ics-cert@hq.dhs.gov

GHSA-w4gc-5pxg-x2jh

Authentication Bypass

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 21:42 vuln.today

CVE Published

Sep 15, 2026 - 21:16 cve.org

HIGH 7.1

DescriptionCVE.org

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests.

AnalysisAI

Unauthenticated HTTP(S) requests to Digital Watchdog VMAX-series video recorders (VMAX A1 G4 DVR, VMAX IP G4 NVR, VG4 Recorder, VMAX A1 PLUS, VA1G4 Recorder) can bypass authentication and return sensitive device data, including administrator credentials in plaintext. The flaw is a missing authentication check on a critical function (CWE-306) scored 7.1 with a CVSS 4.0 vector of AV:A/AC:L/PR:N/UI:N/VC:H, meaning adjacent-network attackers with no credentials and no user interaction can fully read the exposed information but cannot modify or disrupt the device. …