The vulnerability manifests as missing authorization on state‑changing CGI endpoints and the absence of session checks, allowing an attacker to send crafted requests that modify device configuration. Failure to enforce authorization means any user who can reach the device can change settings, trigger actions, or disable security features, creating opportunities for denial of service, data tampering, or further exploitation. This flaw is classified as CWE-862, reflecting the lack of privilege enforcement.

Digital Watchdog devices are affected, including the VA1G4 Recorder, VG4 Recorder, VMAX A1 G4 DVR, VMAX A1 PLUS, and VMAX IP G4 NVR lineups. No specific firmware versions are listed, but all models in these product families are vulnerable. Updated firmware that resolves the authorization issue has been released and can be obtained from the vendor’s download portal.

The CVSS score of 9.4 marks the flaw as critical, indicating that remote attackers can achieve high‑impact actions. The EPSS score of less than 1% suggests a low but nonzero likelihood of exploitation in the wild, and the vulnerability is not currently in the CISA KEV catalog. The attack vector is inferred to be remote over the network, as the flaw involves unauthenticated HTTP requests to CGI exploited from any network segment that can reach the device’s management interface.