The vulnerability arises from a missing authentication check for a critical function that grants root-level access. The flaw allows an attacker to transmit arbitrary bytes to the device, which the firmware then passes directly to a system command without validation. This results in the ability to execute arbitrary code, compromising confidentiality, integrity, and availability of the device. The weakness corresponds to CWE-306, representing an authentication bypass.

Affected vendors include Digital Watchdog. The impacted models are the VA1G4 Recorder, VG4 Recorder, VMAX A1 G4 DVR, VMAX A1 PLUS, and VMAX IP G4 NVR. No specific firmware or version range is listed, so any device running the referenced product lineups is considered potentially vulnerable until a patched firmware is applied.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not currently listed in the CISA KEV catalog, which may reflect limited known exploitation. The likely attack vector is remote network access to the device’s management interface, where the unauthenticated function can be invoked directly by an attacker in the local network or over the internet if exposed. Successful exploitation would grant full root control over the device.