CVE-2026-66890: Hard-Coded Credentials Auth Bypass Flaw

CVE-2026-66890 Overview

CVE-2026-66890 is a hard-coded credentials vulnerability [CWE-798] affecting products distributed by Digital Watchdog. The affected devices ship with embedded credentials that grant remote access to the File Transfer Protocol (FTP) service with root privileges. Any attacker with network reachability to the FTP service can authenticate using the static credentials and read or modify files owned by root. CISA published details in advisory ICSA-26-258-01, categorizing the issue as an operational technology (OT) risk.

Critical Impact
Remote attackers on an adjacent network can log in over FTP using hard-coded credentials and gain root-level read/write access to affected devices.

Affected Products

Digital Watchdog products enumerated in CISA advisory ICSA-26-258-01
Firmware images distributed through the Digital Watchdog downloads portal
Deployments exposing the FTP service on reachable network segments

Discovery Timeline

2026-09-15 - CVE-2026-66890 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-66890

Vulnerability Analysis

The affected products contain hard-coded credentials that authenticate the built-in FTP service. Because the credentials are embedded in firmware, every deployed unit accepts the same username and password combination. An attacker who reaches the FTP port can authenticate without prior compromise or credential theft. The FTP session runs as root, so successful login exposes the entire filesystem for read and write operations.

Root-level FTP access allows attackers to retrieve configuration files, private keys, and captured media. Attackers can also overwrite binaries, startup scripts, or configuration files to persist on the device. Modification of system files enables lateral movement and follow-on attacks against connected OT and IT assets.

Root Cause

The root cause is the inclusion of static, non-removable credentials in the shipped firmware image, classified as [CWE-798] Use of Hard-Coded Credentials. The credentials cannot be rotated or disabled by operators through supported configuration channels. This design decision eliminates the authentication boundary that FTP is expected to enforce.

Attack Vector

Exploitation requires network access to the FTP service on the affected device. The CVSS vector lists an Adjacent Network attack vector with low complexity and no privileges or user interaction required. An attacker on the same broadcast domain, VLAN, or routed OT segment initiates a standard FTP session and supplies the embedded credentials. Once authenticated, the attacker issues FTP commands to enumerate directories, download sensitive files, and upload replacement binaries. No exploit code is required because the attack uses standard FTP client functionality.

Detection Methods for CVE-2026-66890

Indicators of Compromise

FTP authentication events on affected devices originating from unexpected internal hosts or management workstations
Unscheduled STOR, DELE, or RETR commands against system directories such as /etc, /root, or firmware paths
New or modified startup scripts, cron entries, or service binaries with recent timestamps
Outbound connections from the device to unknown destinations following an FTP session

Detection Strategies

Inspect network traffic for FTP control channel activity (TCP/21) targeting affected devices and alert on any successful USER/PASS sequence
Correlate FTP session logs with file integrity monitoring on device configuration exports to identify unauthorized writes
Deploy signature or protocol-aware rules that flag FTP logins using the vendor-published default account names

Monitoring Recommendations

Capture and retain FTP session metadata from OT network taps and span ports for retrospective analysis
Baseline expected FTP client sources; alert on any new source address contacting the device
Monitor device management interfaces for changes to running configuration, firmware version, and file hashes

How to Mitigate CVE-2026-66890

Immediate Actions Required

Block inbound TCP/21 to affected devices at the nearest firewall or OT segmentation boundary
Place affected devices behind a jump host or management VLAN that enforces strong authentication
Inventory all Digital Watchdog devices against CISA advisory ICSA-26-258-01 and prioritize internet-adjacent units
Review recent FTP session logs and file integrity data for signs of prior exploitation

Patch Information

Refer to the CISA ICS Advisory ICSA-26-258-01 and the Digital Watchdog Downloads portal for vendor-supplied firmware updates. The machine-readable advisory data is available in the GitHub CSAF Data File. Apply the latest firmware images provided by Digital Watchdog for the affected models.

Workarounds

Disable the FTP service on affected devices where the vendor firmware allows the setting to be turned off
Restrict FTP reachability using access control lists that permit only authorized management stations
Terminate FTP traffic at a protocol-aware proxy that enforces separate authentication before reaching the device
Segment affected devices onto isolated OT networks with no direct routing from corporate or guest networks

bash

# Example firewall rule to block FTP to affected device range
iptables -I FORWARD -p tcp --dport 21 -d 10.0.50.0/24 -j DROP
iptables -I FORWARD -p tcp --dport 21 -s 10.0.10.0/24 -d 10.0.50.0/24 -j ACCEPT