Multiple vulnerabilities were disclosed in digital video surveillance products as of September 17, 2026, including critical flaws in VMAX DVR/NVR devices and CareCam CM2507 systems that could allow attackers to gain administrative control and access live video feeds. A separate AVideo vulnerability (CVE-2026-92578) allows attackers to log in using stolen password hashes.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected: VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The following versions of CareCam CM2507 are affected: HMT.CM2507 Firmware v251211.1507 (CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-20
CVE-2026-92578 - avideo AVideo stores password hashes in a way that, if someone obtains those hashes, they can use them to sign in as any user without knowing the actual passwords. This means an attacker who… Too many irrelevant or confusing CVEs? Use stackflag.com #avideo #wwbn #CVE #infosec AVideo stores password hashes in a way that, if someone obtains those hashes, they can use them to sign in