| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2026-42951 | 5.4 | medium |
An authenticated user can download a backup of the device which includes account data and password hashes.
|
| CVE-2026-42941 | 8.3 | high |
The VDR device includes a default username and password, with no enforced password change.
|
| CVE-2026-42929 | 8.3 | high |
The device includes default accounts with hard-coded credentials.
|
| CVE-2026-40425 | 5.7 | medium |
The administrator account for the web interface can directly edit sensitive files related to authentication, potentially changing the root password.
|
| CVE-2026-44611 | 5.4 | medium |
Passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
|