JVN#88864366
Atsumi Electric DVRs contain hidden functionality issues

Overview

Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. contain hidden functionality issues.

Products Affected

• ADX5004/ADX5008/ADX404 versions prior to Ver.10.8.237
• ADX3004/ADX3008/ADX3016/ADX204 versions prior to Ver.10.8.237
• ADX1004/ADX1008/ADX2016 all versions

Description

Multiple DVRs provided by Atsumi Electric Co., Ltd. contain multiple vulnerabilities listed below:

• Hidden Functionality (CWE-912)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
  • CVE-2026-97627
• Hidden Functionality (CWE-912)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Base Score 6.9
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N Base Score 4.9
  • CVE-2026-100737

Impact

• A user who can log in to the product with the administrator privilege may execute arbitrary OS commands (CVE-2026-97627).
• A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware (CVE-2026-100737).

Solution

For ADX5004/ADX5008/ADX404/ADX3004/ADX3008/ADX3016/ADX204:
Update the firmware
Update the firmware to the latest version according to the information provided by the developer.

For ADX1004/ADX1008/ADX2016:
As several years have passed since the products were discontinued, no firmware update will be provided.
Apply the Workaround
The developer recommends using the producs without a network connection.
Stop using the products
If the product needs to be used with a network connection, consider using a successor product.