CVE-2026-68950: Hard-Coded Credentials Auth Bypass Vulnerability

CVE-2026-68950 Overview

CVE-2026-68950 is a hard-coded credentials vulnerability [CWE-798] affecting Digital Watchdog products that expose an FTP daemon. The embedded credentials allow an attacker on an adjacent network to authenticate to the ftpd service, which runs with root privileges. Successful authentication grants remote root-level file access to the underlying system wherever FTP is reachable. CISA published this issue as ICS advisory ICSA-26-258-01, reflecting its relevance to operational technology (OT) and physical security environments.

Critical Impact
An attacker with adjacent network access can log in to the ftpd service using undocumented hard-coded credentials and read, modify, or replace arbitrary files as root.

Affected Products

Digital Watchdog products identified in CISA advisory ICSA-26-258-01
Devices exposing the affected ftpd service on the network
Firmware versions listed in the vendor advisory referenced by CISA

Discovery Timeline

2026-09-15 - CVE-2026-68950 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database
2026-09-16 - CISA published ICS advisory ICSA-26-258-01

Technical Details for CVE-2026-68950

Vulnerability Analysis

The flaw is a Use of Hard-coded Credentials weakness [CWE-798] in the FTP daemon shipped with the affected Digital Watchdog products. The device firmware ships with a fixed username and password pair that is not surfaced to administrators and cannot be rotated through normal configuration. Because the ftpd process runs as root, any client that presents these credentials receives an authenticated session with unrestricted file system access.

An attacker who reaches the FTP port on an affected device can list, download, upload, and overwrite arbitrary files. This includes configuration files, binaries, startup scripts, and recorded media. The vulnerability undermines the confidentiality, integrity, and availability of the entire device without requiring any prior credential theft or user interaction.

Root Cause

The root cause is the inclusion of static, hard-coded credentials in shipped firmware combined with an FTP service that executes as the root user. Static credentials embedded in firmware can be recovered through binary analysis or leaked documentation, after which every deployed device using that firmware becomes vulnerable.

Attack Vector

The CVSS 4.0 vector lists an Adjacent Network attack vector, meaning the attacker must be able to reach the device on a local segment, VPN, VLAN, or routed OT network that exposes the FTP port. No privileges and no user interaction are required. Once connected, the attacker authenticates with the hard-coded credentials and interacts with the file system as root through standard FTP commands such as LIST, RETR, STOR, and DELE.

No verified proof-of-concept exploit code is published in the referenced advisories. Technical details describing the exact credentials and firmware images are available in the CISA ICS Advisory and the CSAF machine-readable advisory.

Detection Methods for CVE-2026-68950

Indicators of Compromise

Successful FTP authentication events on affected Digital Watchdog devices from unexpected source addresses.
STOR, DELE, or RNFR/RNTO FTP commands that modify system binaries, startup scripts, or configuration files.
New or altered files in root-owned directories on the device following an FTP session.
Outbound FTP data transfers of unusually large size from devices that normally do not serve files.

Detection Strategies

Inspect network traffic for FTP control-channel sessions (TCP/21) to and from Digital Watchdog appliances and alert on any session originating outside authorized management ranges.
Correlate FTP session metadata with device inventory to flag any authentication event on devices that should have FTP disabled.
Perform firmware version checks against the fixed builds listed in the vendor and CISA advisories to identify unpatched assets.

Monitoring Recommendations

Enable logging on network sensors and firewalls to capture FTP command traffic to OT segments containing video surveillance equipment.
Alert on repeated FTP login attempts, especially from IT segments, wireless networks, or remote-access concentrators that should not manage recorders.
Baseline normal device behavior and flag deviations such as unscheduled configuration file writes or new executables appearing on the device.

How to Mitigate CVE-2026-68950

Immediate Actions Required

Apply the firmware update published on the Digital Watchdog Downloads page as soon as it is available for the affected model.
Block inbound TCP/21 to affected devices at perimeter and internal firewalls until patched.
Place affected devices on isolated VLANs that only permit traffic from authorized management workstations.
Audit device logs and file systems for evidence of unauthorized FTP access or modification of system files.

Patch Information

Digital Watchdog distributes firmware updates through its downloads portal. Refer to CISA advisory ICSA-26-258-01 for the list of fixed firmware versions and to the Digital Watchdog Downloads site to obtain the corresponding images. Verify firmware integrity before installation and confirm the patched version after upgrade.

Workarounds

Disable the FTP service on affected devices if operational workflows permit.
Restrict FTP access with host-based ACLs so that only a small set of management IP addresses can reach TCP/21.
Terminate management access to affected devices inside a jump host or bastion segment rather than exposing FTP directly.
Follow CISA's defense-in-depth guidance for ICS/OT deployments, including network segmentation and VPN-gated remote access.

bash

# Example: block inbound FTP to a device subnet using iptables
iptables -A FORWARD -p tcp --dport 21 -d 10.10.20.0/24 -j DROP
iptables -A FORWARD -p tcp --dport 20 -d 10.10.20.0/24 -j DROP